Core Contracts

Summary

A precision loss issue exists in the calculateCompoundedInterest function, which results in the ratePerSecond calculation potentially being zero. This leads to no interest being accrued for borrowers while lenders continue to receive their interest. As a result, the interest source for lenders (borrowers' payments) may not be correctly accounted for, causing an imbalance in the protocol.

Severity

High - The bug leads to incorrect interest accrual calculations, potentially disrupting the lender-borrower balance and leading to economic losses.

Impact

• Borrowers may not be charged interest if ratePerSecond rounds to zero due to precision loss.

• Lenders continue receiving interest payments, creating a situation where payouts exceed collected interest.

• Protocol funds could be drained over time due to this misalignment.

Vulnerability Details

Issue in calculateCompoundedInterest

• Issue: ratePerSecond can become zero due to integer division rounding down.

• Consequence: If ratePerSecond is zero, the interest factor remains 1 (no interest accrual), leading to an imbalance where borrowers do not pay interest, but lenders continue earning it.