Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`usageIndex` can't be updated due the missing call function in `LendingPool` to`DebtToken::updateUsageIndex`

kiteweb3

Summary

The usageIndex represents the cumulative interest rate accrual for debt. It can be updated calling the DebtToken::updateUsageIndex function. But this functions is restricted to be called only by the LendingPool contract (reserve pool) through the onlyReservePool modifier. However, the LendingPool contract lacks a public function to call DebtToken::updateUsageIndex, making it impossible to update the usageIndex. While the usage index is updated through ReserveLibrary.updateReserveState(), there's no direct way to modify it when needed.

Vulnerability Details

@> function updateUsageIndex(uint256 newUsageIndex) external override onlyReservePool {
if (newUsageIndex < _usageIndex) revert InvalidAmount();
_usageIndex = newUsageIndex;
emit UsageIndexUpdated(newUsageIndex);
}

Impact

The LendingPool cannot adjust the usage index if necessary.

Tools Used

Manual review

Recommendations

Add an external function in the LendingPool contract to allow authorized updates to the usage index.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] Unused _usageIndex Variable and updateUsageIndex() Function in DebtToken Contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.