Core Contracts

Summary

The _repay and finalizeLiquidation functions have the wrong sequence of returned values from the DebtToken::burn function which causes the borrowers to never have to pay interest on the reserve assets they have borrowed.

Vulnerability Details

The burn function of the DebtToken returns the following variables:

Note the order of the variables returned by the function.

When the same function is called by the LendingPool::repay contract, it has the following code snippet:

In line 1 above, it has the places of amountScaled and amountBurned swapped. Let's keep note that from this line onwards, the variable named amountScaled is actually the amountBurned and the amountBurned is actually the amountScaled.

In line 2 shown above, we can see that the reserve asset is transferred from the msg.sender to the reserve address since this is the debt repay function. It transfers the amountScaled which, keep in mind is actually the amount of DebtTokens burned. So, this is the wrong amount of tokens to transfer back.

This actually happens in the liquidation function as well, as shown below:

Impact

This bug causes the wrong amount to be transferred back when the borrower calls the repay function. Initially, when the borrow function is called, they mint the DebtToken in a 1:1 ratio to the reserve asset before any interest is applied to it. Because of that, the platform will never be able to collect interest, and the borrower will always return only the principal amount of the loan.

Tools Used

Manual Review.

Recommendations

Just need to ensure the correct sequence of the returned variables.