Submission Details
Severity:
Missing Interest Rate Update After Balance Change in `LendingPool::transferAccruedDust` Function
Summary
The transferAccruedDust function in the LendingPool contract fails to update the interest rate after transferring dust tokens, which could lead to stale interest rates not reflecting the new balance state.
Vulnerability Details
function transferAccruedDust(address recipient, uint256 amount) external onlyOwner { <==@found
ReserveLibrary.updateReserveState(reserve, rateData);
require(recipient != address(0), "LendingPool: Recipient cannot be zero address");
}
Impact
Stale interest rates not reflecting current pool state
Potential economic model inefficiencies
Interest rates remain unchanged until next update
Tools Used
Manual Review
Recommendations
Update interest rates after transferring dust tokens:
function transferAccruedDust(address recipient, uint256 amount) external onlyOwner {
ReserveLibrary.updateReserveState(reserve, rateData);
require(recipient != address(0), "LendingPool: Recipient cannot be zero address");
+ updateInterestRate(reserve, rateData);
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::transferAccruedDust doesn't update reserve.totalLiquidity when dust is transferred, causing discrepancy between tracked and actual liquidity
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::transferAccruedDust doesn't update reserve.totalLiquidity when dust is transferred, causing discrepancy between tracked and actual liquidity
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.