Core Contracts

The burn function incorrectly calculates debt repayment by using an outdated _userState[from].index before updating it to the latest index. This results in an incorrect computation of balanceIncrease, which represents the accrued interest. The function fetches borrowIndex from ILendingPool(_reservePool).getNormalizedDebt() after performing calculations based on the outdated index, creating a discrepancy between expected and actual debt repayments. To add, amountScaled = amount.rayDiv(index); incorrectly reduces the repayment amount due to improper scaling, potentially causing debt underpayment. The incorrect execution flow is evident in the following code snippet:

Since amountScaled is calculated before properly updating _userState[from].index, it may be smaller than the actual debt owed, allowing borrowers to repay less than they should. This results in accumulated unpaid interest, leading to a discrepancy between recorded and actual debt.

Impact

Borrowers can underpay their debt, leading to an increasing gap between total outstanding debt and actual repayments, which over time causes protocol insolvency as unpaid interest accumulates.

Mitigation:

Update _userState[from].index before computing balanceIncrease, fetch borrowIndex first, and use borrowIndex instead of index when calculating amountScaled.