Submission Details
Severity:
User have to pay interest even when protocol is paused
Vulnerability Details
In LendingPoolcontract, in multiple functions like deposit(), withdraw(), ..., it will call updateReserveState()function before doing any action. It will call updateReserveInterests()function:
function updateReserveState(ReserveData storage reserve,ReserveRateData storage rateData) internal {
updateReserveInterests(reserve, rateData);
}
It will update liquidity index and debt index with timeDelta is current block timestamp and last update timestamp:
function updateReserveInterests(ReserveData storage reserve,ReserveRateData storage rateData) internal { //@idea update cả khi pause
uint256 timeDelta = block.timestamp - uint256(reserve.lastUpdateTimestamp); // <--
if (timeDelta < 1) {
return;
}
uint256 oldLiquidityIndex = reserve.liquidityIndex;
if (oldLiquidityIndex < 1) revert LiquidityIndexIsZero();
// Update liquidity index using linear interest
reserve.liquidityIndex = calculateLiquidityIndex(
rateData.currentLiquidityRate,
timeDelta,
reserve.liquidityIndex
);
// Update usage index (debt index) using compounded interest
reserve.usageIndex = calculateUsageIndex(
rateData.currentUsageRate,
timeDelta,
reserve.usageIndex
);
// Update the last update timestamp
reserve.lastUpdateTimestamp = uint40(block.timestamp);
emit ReserveInterestsUpdated(reserve.liquidityIndex, reserve.usageIndex);
}
Which mean it is user's debt is charged even when protocol is paused. They can not repay the debt and have to pay the fee for the paused duration.
Impact
Users are forced to pay fee when protocol is paused.
Recommendations
Do not calculate interest when protocol is paused.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Unfair Liquidation As Borrow Interest Accumulates While Paused
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Unfair Liquidation As Borrow Interest Accumulates While Paused
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.