Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Calculation in `ReserveLibrary::getNormalizedIncome/getNormalizedDebt` Functions Due to Missing Total Amount Multiplication

zgczgc

Summary

The getNormalizedIncome and getNormalizedDebt functions in ReserveLibrary only calculate the index changes without multiplying by the total amounts (totalLiquidity and totalUsage), leading to incorrect normalized values for deposits and debts.

Vulnerability Details

function getNormalizedIncome(ReserveData storage reserve, ReserveRateData storage rateData) internal view returns (uint256) {
uint256 timeDelta = block.timestamp - uint256(reserve.lastUpdateTimestamp);
if (timeDelta < 1) {
return reserve.liquidityIndex; <==@found
}
return calculateLinearInterest(rateData.currentLiquidityRate, timeDelta, reserve.liquidityIndex)
.rayMul(reserve.liquidityIndex); <==@found
}
​
function getNormalizedDebt(ReserveData storage reserve, ReserveRateData storage rateData) internal view returns (uint256) {
uint256 timeDelta = block.timestamp - uint256(reserve.lastUpdateTimestamp);
if (timeDelta < 1) {
return reserve.totalUsage; <==@found
}
return calculateCompoundedInterest(rateData.currentUsageRate, timeDelta)
.rayMul(reserve.usageIndex); <==@found
}

Impact

Incorrect calculation of normalized values for deposits and debts
Potential miscalculation of interest rates
Disruption of protocol's economic model
Risk of protocol insolvency due to incorrect accounting

Tools Used

  • Manual Review

Recommendations

Multiply the total amounts (totalLiquidity and totalUsage) in the getNormalizedIncome and getNormalizedDebt functions.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.