Submission Details
Severity:
LendingPool::setPrimeRate() requires primeRate to be RAY but oracle will not return it in this format
Summary
When oracles return the primeRate amount, it will be decoded to a normalized amount, but not in RAY (27 decimals).
Vulnerability Details
The code suggests newPrimeRate will be (in RAY), but it is not
/**
* @notice Sets a new prime rate for the reserve.
* @param reserve The reserve data.
* @param rateData The reserve rate parameters.
* @param newPrimeRate The new prime rate (in RAY).
*/
function setPrimeRate( ReserveData storage reserve,ReserveRateData storage rateData,uint256 newPrimeRate) internal
This will break calculation of the borrowRate calculateBorrowRate()and the update of interest rates and liquidity updateInterestRatesAndLiquidity()
Impact
Breaking core protocol variables
Tools Used
Manual review
Recommendations
When setting the prime rate carefully convert it to RAY
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.