Core Contracts

## Summary

There is a critical issue in how the utilization rate and the borrow and liquidity rates are calculated in the contract. Specifically, the total debt is incorrectly derived by the getNormalizedDebt function, which returns an interest value rather than the actual total debt( which is total money lent to borrower). This miscalculation leads to incorrect results when calculating the utilization rate and borrowing and liquidity rates, ultimately affecting the contract’s lending and borrowing logic.

## Vulnerability Details

• Issue:
  In the getNormalizedDebt function, the debt is being calculated as compounded interest using the usageIndex, which is incorrect. This approach causes the total debt to reflect an interest factor, not the actual total debt. As a result, when calculating the utilization rate in getBorrowRate and getLiquidityRate, the actual total debt is not being used, leading to incorrect calculations of the utilization rate.

• Affected Code:

• when timeDelta < 1, so it returns reserve.totalUsage which is equal to WadRayMath.RAY = 1e27, when no time has passed when when time has passed, it calculates it differently

  if (timeDelta < 1) {

  return reserve.totalUsage;

  }

  • getNormalizedDebt calculates the total debt as:

    return calculateCompoundedInterest(rateData.currentUsageRate, timeDelta).rayMul(reserve.usageIndex);

    But this should actually return the debt amount, which is calculated as:

    debt = reserve.usageIndex * reserve.totalUsage

  • The calculation of the utilization rate in the getBorrowRate and getLiquidityRate functions is based on the incorrect getNormalizedDebt function:

    uint256 utilizationRate = calculateUtilizationRate(reserve.totalLiquidity, totalDebt);

  • The calculation of total debt in the getBorrowRate and getLiquidityRate functions will be incorrect because totalDebt is calculated as interest, not the real total debt.

## Impact

• Incorrect Utilization Rate Calculation:
  The utilization rate will be incorrect because the total debt value used in its calculation is not accurate. This leads to faulty rate calculations for both borrowing and liquidity, which impacts the entire lending and borrowing process.

• Invalid Borrowing and Liquidity Rates:
  Since the borrow and liquidity rates depend on the utilization rate, these rates will also be incorrect. Borrowers could be charged the wrong rates, and liquidity providers may receive the wrong rewards.

## Tools Used

• **Manual Code **

## Recommendations

1. Correct Debt Calculation:
   Modify the getNormalizedDebt, in order when timeDelta is more than 1 it should multiply totalUsage = totalDebt * usageIndex this is how correct totalDebt will be calculated.

   return reserve.usageIndex.rayMul(reserve.totalUsage);