Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Uninvoked `DebtToken::updateUsageIndex` Function in LendingPool Leads to Stale Data in DebtToken contract

0x23r0

Summary

The updateUsageIndex function in the DebtToken contract is designed to be called by the LendingPool (ReservePool) to update the critical _usageIndex parameter. However, the LendingPool lacks a mechanism to invoke this function, resulting in an outdated _usageIndex.

Vulnerability Details

This updateUsageIndex function update the _usageIndex that must be synchronized with the reserve.usageIndex in the lendingPool contract, While updateUsageIndex is protected by the onlyReservePool modifier, the LendingPool does not call this function.

function updateUsageIndex(uint256 newUsageIndex) external override onlyReservePool {
if (newUsageIndex < _usageIndex) revert InvalidAmount();
_usageIndex = newUsageIndex;
emit UsageIndexUpdated(newUsageIndex);
}
​

The _usageIndex is intended to reflect real-time usage metrics (e.g., debt utilization). Without updates from the LendingPool, it becomes obsolete.

Impact

_usageIndex not synchronized with the reserve.usageIndex in the lendingPool contract. As a result, the value returned by getUsageIndex in DebtToken contract be outdated, leading to misaligned calculations.

function getUsageIndex() external view override returns (uint256) {
return _usageIndex;
}

Tools Used

Manual Review

Recommendations

Call DebtToken.updateUsageIndex(newValue) during key actions in the LendingPool that synchronized with the reserve.usageIndex.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] Unused _usageIndex Variable and updateUsageIndex() Function in DebtToken Contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!