Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

DebtToken usage index stale because its value cannot be updated

crunter

Summary

The call to the DebtToken updateUsageIndex function is not implemented within the Lending pool contract, which makes this function unreachable and causes the _usageIndex value to remain at the initial value. This mainly affects the external function DebtToken::getUsageIndex, as it will always return an outdated value.

Vulnerability Details

In the DebtToken contract, updateUsageIndex function uses the onlyReservePool modifier. The reserve pool is assigned to the Lending pool contract as it is allowed to mint/burn debt tokens. However, call to the DebtToken::updateUsageIndex function is not implemented within the Lending pool contract, turning this functionality unreachable and causing the _usageIndex value to remain at its initial value.

> DebtToken.sol
​
@> function updateUsageIndex(uint256 newUsageIndex) external override onlyReservePool {
// @audit - call to this function is not implemented in the Lending Pool contract
if (newUsageIndex < _usageIndex) revert InvalidAmount();
_usageIndex = newUsageIndex;
emit UsageIndexUpdated(newUsageIndex);
}

Impact

Impact: Low

This issue mainly affects users who want to know the _usageIndex value by calling the getUsageIndex function, as they will get the default value 1e27 (WadRayMath.RAY).

Likelihood: Medium

Tools Used

Manual Review

Recommendations

It is recommended to implement the call to the DebtToken::updateUsageIndex function in the Lending Pool contract or remove the related features in the DebtToken contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] Unused _usageIndex Variable and updateUsageIndex() Function in DebtToken Contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!