Core Contracts

Summary:

_repay() in LendingPool clamps amount to actualRepayAmount but still calls DebtToken.burn(...) with the original amount, relying on the DebtToken to clamp again.

Vulnerability Details:

Mismatch can create confusion or dust leftover, as the final burn amount is decided internally by DebtToken.

Impact:

Not exploitable in typical scenarios, but could lead to partial reverts or leftover debt if misused.

Tools Used:

• Manual code reading

• Tracing repay flow (LendingPool, DebtToken)

Recommendations:

• Pass the properly capped actualRepayAmount to debtToken.burn(...) for clarity and to avoid partial dust.