Core Contracts

Summary

The DebtToken contract implements a debt token for the RAAC lending protocol. However, the _usageIndex variable and the updateUsageIndex() function are defined but never utilized. These elements are critical in the context of interest accrual and debt tracking, and their absence from usage significantly undermines the contract's intended functionality. This leads to inaccurate debt management and potential failures in the protocol's operation.

Vulnerability Details

Unused _usageIndex Variable: The _usageIndex variable is designed to track debt accumulation over time using an index-based system, similar to protocols like Aave's VariableDebtToken. However, it is never utilized within the contract, making it ineffective for its intended purpose.

Unused updateUsageIndex() Function: The updateUsageIndex() function is intended to allow the reserve pool to update the _usageIndex, adjusting the debt over time as interest accumulates. But the function is never called or used within the contract, leading to the same issue of debt not scaling correctly.

The primary function of the DebtToken is to represent the debt users accumulate over time, reflecting the accrual of interest via the _usageIndex. Without the correct use of this index, the debt token system cannot properly track or adjust the debt over time, breaking the intended mechanics.

Check this Doc url.

Impact

• Incorrect Debt Accrual: Without the _usageIndex being updated, users' debt balances will not reflect the interest accumulation over time. The contract will not scale users' debt, which is fundamental to how debt tokens are meant to function in the RAAC lending protocol.

• Minting and Burning Issues: The minting and burning functions depend on the _usageIndex to calculate the correct debt amount. Without this index, users may receive the wrong amount of debt tokens when they borrow or burn too few or too many tokens when repaying their debt.

• Lending Pool and Protocol Integration Failures: The integration with the lending pool relies on accurate debt tracking. Without a functioning _usageIndex, the protocol cannot track or settle debt accurately, which could cause synchronization issues between the contract and the lending pool.

• Loss of Protocol Integrity: The debt system will not function as intended, leading to potential financial imbalances, where users may not owe the correct amount of debt tokens, and the protocol would fail to perform necessary debt-related actions such as liquidation or rewards.

• Unpredictable Behavior: Other contract features that rely on the debt token system may fail, leading to system-wide instability.

Tools Used

Manual review

Recommendations

Implement or Remove _usageIndex and updateUsageIndex():

• If the _usageIndex and updateUsageIndex() are required for future functionality (for tracking interest accrual), they should be properly integrated into the debt scaling mechanism. Ensure that the index is updated and used in calculations when users borrow or repay debt.

• If these components are no longer necessary or intended for future use, they should be removed from the contract to avoid unnecessary complexity, storage consumption, and gas costs.

Ensure Proper Debt Scaling Mechanism:

• If the purpose of _usageIndex is to manage interest and debt scaling, review and implement the logic necessary to scale the debt over time, ensuring the minting and burning mechanisms reflect the actual debt positions of users.