Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect Return Value in `DebtToken::getUsageIndex()`

joicygiore

Summary

The _usageIndex variable in DebtToken has been deprecated, resulting in the getUsageIndex() function returning an incorrect value.

Vulnerability Details

Originally, _usageIndex was used to represent cumulative interest accumulation. However, in the current implementation, updateUsageIndex() is no longer used to update this value, and _usageIndex is no longer factored into interest calculations.

// Usage index, represents cumulative interest
uint256 private _usageIndex;
​
constructor(string memory name, string memory symbol, address initialOwner) ERC20(name, symbol) ERC20Permit(name) Ownable(initialOwner) {
if (initialOwner == address(0)) revert InvalidAddress();
@> _usageIndex = uint128(WadRayMath.RAY); // 1e27
}
​
// Deprecated ❌
function updateUsageIndex(uint256 newUsageIndex) external override onlyReservePool {
if (newUsageIndex < _usageIndex) revert InvalidAmount();
_usageIndex = newUsageIndex;
emit UsageIndexUpdated(newUsageIndex);
}

Since _usageIndex is no longer updated, calling getUsageIndex() returns an outdated and incorrect value:

function getUsageIndex() external view override returns (uint256) {
return _usageIndex;
}

Impact

Because _usageIndex is no longer maintained, any function or contract relying on getUsageIndex() will receive an inaccurate value, potentially leading to incorrect interest calculations or misrepresentation of debt metrics.

Tools Used

Manual Review

Recommendations

Modify the function to retrieve the correct interest index from the lending pool instead of returning the outdated _usageIndex:

function getUsageIndex() external view override returns (uint256) {
- return _usageIndex;
+ return ILendingPool(_reservePool).getNormalizedDebt();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] Unused _usageIndex Variable and updateUsageIndex() Function in DebtToken Contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.