Submission Details
Severity:
reserve state should be updated before LendingPool::setPrimeRate()
Summary
reserve state such as liquidity index, debt index should be updated before set a new primeRate
Vulnerability Details
LendingPool::setPrimeRate() is meant for setting a new PrimeRate for the reserve. After the PrimeRate changes, reserve will updated to a new usageRate, which will results to new debt Index. Debt will be accumulated at a different debt rate.
function setPrimeRate(uint256 newPrimeRate) external onlyPrimeRateOracle {
ReserveLibrary.setPrimeRate(reserve, rateData, newPrimeRate);
}
function setPrimeRate( ReserveData storage reserve,ReserveRateData storage rateData,uint256 newPrimeRate) internal {
if (newPrimeRate < 1) revert PrimeRateMustBePositive();
uint256 oldPrimeRate = rateData.primeRate;
if (oldPrimeRate > 0) {
uint256 maxChange = oldPrimeRate.percentMul(500); // Max 5% change
uint256 diff = newPrimeRate > oldPrimeRate ? newPrimeRate - oldPrimeRate : oldPrimeRate - newPrimeRate;
if (diff > maxChange) revert PrimeRateChangeExceedsLimit();
}
rateData.primeRate = newPrimeRate;
updateInterestRatesAndLiquidity(reserve, rateData, 0, 0);
emit PrimeRateUpdated(oldPrimeRate, newPrimeRate);
}
Therefor reserve state: liquidity index/debt index must be updated before such a change.
Impact
protocol may accumulate an unfair debt under different debt index.
Tools Used
manual
Recommendations
consider updating reserve state before setPrimeRate()
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
setPrimeRate applies new rates retroactively by updating rates after changing primeRate, causing incorrect interest calculations for past periods
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
setPrimeRate applies new rates retroactively by updating rates after changing primeRate, causing incorrect interest calculations for past periods
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.