Core Contracts

Summary

The totalSupply() function in the DebtToken contract incorrectly scales the total supply by using rayDiv(ILendingPool(_reservePool).getNormalizedDebt()). This miscalculation leads to underestimated debt totals, which causes inconsistencies in reserve balances and impacts liquidity and utilization rate calculations.

Vulnerability Details

The function is designed to return the total supply of debt tokens, but it incorrectly scales down the value instead of properly adjusting it. The problematic implementation is shown below:

Issue:

• The function divides by getNormalizedDebt() instead of multiplying it by (rayDiv instead of rayMul).

• This reduces the total reported supply of debt tokens instead of properly adjusting it to reflect accumulated interest.

• The incorrect total supply calculation impacts reserve.totalUsage, which is a crucial variable for determining liquidity and utilization rates in the reserve library.

Impact

Critical Miscalculation of Total Debt: The protocol underestimates the total debt supply, which skews interest rate calculations and utilization metrics.

Unstable Liquidity & Utilization Rates: The reserve library relies on reserve.totalUsage to compute utilization and liquidity rates. If these are calculated with incorrect data, it will lead to mispriced loans, unintended interest fluctuations, and protocol instability.

Tools Used

Manual Review

Recommendations

To ensure correct debt tracking, modify totalSupply() to properly scale up instead of scaling down: