Core Contracts

Summary

The getNormalizedDebt function returns an interest factor rather than the actual debt amount. It should return the debt amount multiplied by the compounded interest, but it currently returns just the compounded interest multiplied by the usage index.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/pools/ReserveLibrary.sol#L467-L474

In the getNormalizedDebt function, the calculation for normalized debt is incorrect. This returns the interest factor based on the usage rate and the usage index, but it does not account for the actual total debt (reserve.totalUsage). The getNormalizedDebt function should calculate the total debt by applying compounded interest to the current debt (reserve.totalUsage), not just the usage index.

Impact

If the function is not corrected, it may return incorrect debt values, which can affect interest calculations and other downstream logic, potentially leading to financial errors or exploits.

Tools Used

Manual review

Recommendations

To fix the issue, modify the return statement in getNormalizedDebt to include the actual debt amount (reserve.totalUsage) multiplied by the interest factor: