Core Contracts

Summary

The use of stale liquidity index in RToken.sol will cause a financial loss for users as the transfers are calculated using outdated index values, resulting in incorrect scaled amounts being transferred.

Root Cause

In RToken.sol the _update() function uses a stale liquidity index from LendingPool.sol that has not been updated to the current timestamp.

The core issue lies in how the liquidity index is retrieved and used:

The getNormalizedIncome() function simply returns the stored liquidityIndex without updating it:

Internal pre-conditions

1. Time must have passed since the last liquidityIndex update

2. User must transfer RTokens using the transfer(), transferFrom() or related functions

Attack Path

1. User A initiates a transfer of RTokens to User B

2. The transfer uses a stale liquidityIndex value instead of the current one

3. The scaled amount calculation results in a larger value than it should be

4. User A loses more value than they should in the transfer

Impact

Users transferring RTokens suffer a loss proportional to the time elapsed since the last liquidity index update and the current liquidity rate. The extra value is effectively lost in the scaling calculation.

Mitigation

Modify LendingPool.sol#getNormalizedIncome() to calculate and return the current liquidity index based on the time elapsed since the last update.