Core Contracts

Summary

A systemic vulnerability exists in the protocol where interest rates are updated after token transfers in critical functions such as deposit, withdraw, borrow, _repay, and finalizeLiquidation in LendingPool contract. This leads to incorrect interest rate calculations, inflated indices, and user financial losses. The issue arises because the utilization ratio (which directly affects interest rates) changes due to token transfers. Still, the interest rates are not updated to reflect these changes before the next user interaction.

Vulnerability Details

In the current implementation, the updateInterestRatesAndLiquidity function is called after token transfers in all critical functions. This means that the utilization ratio (the ratio of total debt to total liquidity) is not updated before the next user interaction, leading to incorrect interest rate calculations. The utilization ratio rises or falls depending on deposits and withdrawals, and the interest rate is directly tied to this ratio. If the interest rate is not updated before token transfers, the next user will interact with the protocol using an outdated utilization ratio, leading to incorrect calculations.

Code Examples

For all the functions below, the interest rate is updated after the token transfer

1. deposit function: https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/pools/ReserveLibrary.sol#L347

2. withdraw: https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/pools/ReserveLibrary.sol#L386
   knowing that the transfer occurs while burning rtoken

3. borrow: https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L363

4. repay: https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L428

5. finalizeLiquidation: https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L532

We can look at Aave v3's code which the protocol is highly inspired, and we can see that interest rates are always updated before any token transfers to ensure accurate calculations

• https://github.com/aave/aave-v3-core/blob/782f51917056a53a2c228701058a6c3fb233684a/contracts/protocol/libraries/logic/SupplyLogic.sol#L65

• https://github.com/aave/aave-v3-core/blob/782f51917056a53a2c228701058a6c3fb233684a/contracts/protocol/libraries/logic/SupplyLogic.sol#L130

• https://github.com/aave/aave-v3-core/blob/782f51917056a53a2c228701058a6c3fb233684a/contracts/protocol/libraries/logic/BorrowLogic.sol#L145-L150

• https://github.com/aave/aave-v3-core/blob/782f51917056a53a2c228701058a6c3fb233684a/contracts/protocol/libraries/logic/BorrowLogic.sol#L227-L232

Impact

The impact of this vulnerability is significant and affects all critical functions in the protocol:

1. Deposit: The utilization ratio decreases, but the interest rate is not updated. The next user interacting with the protocol will use an outdated (higher) utilization ratio, leading to incorrect interest rate calculations.

2. Withdraw: The utilization ratio increases, but the interest rate is not updated. The next user interacting with the protocol will use an outdated (lower) utilization ratio, leading to incorrect interest rate calculations.

3. Borrow: The utilization ratio increases, but the interest rate is not updated. The next user interacting with the protocol will use an outdated (lower) utilization ratio, leading to incorrect interest rate calculations.

4. Repay: The utilization ratio decreases, but the interest rate is not updated. The next user interacting with the protocol will use an outdated (higher) utilization ratio, leading to incorrect interest rate calculations.

5. Liquidation: The utilization ratio changes, but the interest rate is not updated. The next user interacting with the protocol will use an outdated utilization ratio, leading to incorrect interest rate calculations.

Tools Used

Manual review

Recommendations

Interest rates should be updated before any token transfers

Note that in the borrow function, interest rates should be updated before token transfer, but after minting debt token

Same for repay function, interest rates should be updated before token transfer, but after burning debt token