Core Contracts

Summary

Interest will be updated incorrectly in setPrimeRate

Vulnerability Details

The owner can send one request to update the prime rate. When we receive the response data, we will set the lending pool's prime rate. In the function setPrimeRate, we will update the primeRate at first, then we will accrue the borrow interest in the previous time slot via updating the related liquidity index and usage index with the updated prime rate.

This is incorrect. The previous time slot's borrow interest should be calculated based on the previous prime rate and previous borrow rate.

For example:

1. Alice deposits some funds in the lending pool in timestamp X.

2. Bob borrows some funds from the lending pool in timestamp X + 100. After bob's borrow, the currentUsageRate is a1.

3. The owner sends one request to update the prime rate in timestamp X + 500. Assume we get the response in timestamp X + 510. Here we update the currentUsageRate to a2. The borrow interest between timestamp X + 100 and timestamp X + 510 will be calculated with the updated usage rate a2. This is incorrect. We should use a1 to accrue the borrow interest between timestamp X + 100 and timestamp X + 510.

Impact

The borrow interest's calculation is incorrect.

Tools Used

Manual

Recommendations

Accrue the borrow interest, update the usage index, liquidity index before we update the prime rate.