Core Contracts

Summary

Several setter functions in the LendingPool contract do not check if the new value is the same as the current value before updating it. This can result in unnecessary transactions, leading to increased gas costs without any state change. However, a similar function (setStabilityPool) correctly implements this check.

Affected Functions

• setPrimeRate(uint256 newPrimeRate)

• setPrimeRateOracle(address newOracle)

• setProtocolFeeRate(uint256 newProtocolFeeRate)

• setCurveVault(address newVault)

Vulnerability Details

These functions directly update contract storage variables without verifying whether the new value is the same as the existing value. This oversight can lead to redundant state updates and unnecessary gas consumption.

For example, in setPrimeRateOracle:

However, the setStabilityPool function properly validates the same-value condition:

Recommendation

Add same-value checks to all affected functions. Example fix for setPrimeRateOracle:

Severity: Low

• Impact: Low (no direct security or financial risk, but inefficient gas usage)

• Likelihood: Medium (setters are likely to be used, leading to inefficiencies)