Core Contracts

## Summary

The current implementation of the getUserDebt, getNormalizedIncome, and getNormalizedDebt functions may return stale values because they do not account for the latest updates to the reserve's liquidity and usage indices. The indices grow over time, and if they are not updated before retrieving these values, the data returned to the user will be outdated. To fix this issue, the reserve's state should be updated before querying these values to ensure that the latest interest rates are used.

## Vulnerability Details

• Issue:

  • The getUserDebt, getNormalizedIncome, and getNormalizedDebt functions retrieve values based on reserve.liquidityIndex and reserve.usageIndex, but these values can change over time due to accrued interest over the period of time. If the indices are not updated before calling these functions, the results may be stale and inaccurate.

  • The reserve’s liquidity and usage indices are updated using a time delta, which means they change with time. Therefore, when these indices are queried without updating them first, users will get outdated information.

• Affected Code:

  • Functions getUserDebt, getNormalizedIncome, and getNormalizedDebt rely on reserve.liquidityIndex and reserve.usageIndex for calculations.

  • The updateReserveInterests function updates these indices, but this update may not be called before querying the values.

## Impact

• Incorrect Debt and Income Calculation:

  • Users relying on getUserDebt, getNormalizedIncome, and getNormalizedDebt may receive stale data, which will impact the accuracy of their debt calculations and liquidity ratios.

## Tools Used

• Manual code inspection of the getUserDebt, getNormalizedIncome, and getNormalizedDebt functions.

## Recommendations

1. Update Reserve State Before Querying Data:

   • Before calling getUserDebt, getNormalizedIncome, or getNormalizedDebt, ensure that the reserve state is up-to-date by calling the updateReserveState function.

   Example fix:

   function getUserDebt(address userAddress) public view returns (uint256) {

   ReserveLibrary.updateReserveState(reserve, rateData); // Ensure fresh data

   UserData storage user = userData[userAddress];

   return user.scaledDebtBalance.rayMul(reserve.usageIndex);

   }

2. Ensure Consistent Data Across All View Functions:

   • Ensure that all functions that depend on reserve indices (liquidityIndex and usageIndex) always call updateReserveState to get the latest values. This will guarantee that users and other contract functions always work with up-to-date data.