Summary

Missing check that the currentLiquidityRate and the currentUsageRate of the Lending Pool is zero. The reserve continues to update users accured interest over time even when there is no revenue being generated.

Vulnerability Details

In the ReserveLibrary.sol, the reserve interests are updated when updateReserveInterests is invoked. This is goining to be happening on every available functions in the Lending Pool so that appropriate interest are accumulated. However, the issue arises when the reserve interests update persists when the pool is not generating enough revenue to cover for interest generated by the depositors.

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/pools/ReserveLibrary.sol#L121

In comparison to an Aave Lending Pool implementation with shares some similar features, there is a check to ensure that reserve indexes are updated only when the current liquidity and usage rate are non-zero.

See:

https://github.com/aave/protocol-v2/blob/ce53c4a8c8620125063168620eba0a8a92854eb8/contracts/protocol/libraries/logic/ReserveLogic.sol#L347

Impact

Protocol might turn bankrupt if they do not generate enough income to pay depostors of the reserve asset token.

Tools Used

Manual review.

Recommendations

Add checks to confirm that the current liquidity rate and current usage rate is greater than 0 before updating the liquidity and usage index are updated.