Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Outdated usage index in view functions leads to incorrect debt calculations

dobrevaleri

Summary

The LendingPool contract uses an outdated usage index in the getUserDebt() view function, leading to incorrect debt calculations.

Vulnerability Details

The LendingPool::getUserDebt() function directly use reserve.usageIndex without updating it to the current timestamp:

function getUserDebt(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
return user.scaledDebtBalance.rayMul(reserve.usageIndex);
}

The usage index represents the accumulated interest rate over time and should be updated with each block timestamp. The current implementation returns potentially stale values since it doesn't calculate the index for the current timestamp.

The root cause is that these functions directly access storage values instead of using ReserveLibrary.getNormalizedDebt() which properly calculates the up-to-date index.

Impact

Using outdated indices leads to incorrect debt calculations when users check their current debt

Recommendations

Use ReserveLibrary Functions

function getUserDebt(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
- return user.scaledDebtBalance.rayMul(reserve.usageIndex);
+ uint256 currentIndex = ReserveLibrary.getNormalizedDebt(reserve, rateData);
+ return user.scaledDebtBalance.rayMul(currentIndex);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getUserDebt uses stale usageIndex without accounting for accrued interest since last update

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getUserDebt uses stale usageIndex without accounting for accrued interest since last update

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!