Core Contracts

Summary

Protocol fee rate is important in the calculation of the liquidity rate. This rate determines how the interest grows for the lenders. When a new protocol fee rate is set, the interest accrued by the lenders till then is not updated, rather the liquidity rate(because the protocol fee rate is changed first) is directly changed and only after this is the interest on the lenders is applied. This will result in higher/lower interest on the lenders than expected.

Vulnerability Details

From the below code it can be seen that whenever the protocolFee rate is increased the liquidity rate is decreased and vice versa. Thus Updating the protocol fee rate before applying the previous liquidty rate to the lenders accrued interest can lead to loss of funds for the protocol (in case the protocol fee rate is decreased) or a loss of funds for the lenders(if the protocol fee rate is increased)

As the interest accrued by lenders during a time delta depends on the liquidity rate (hence the protocol fee rate by extension), when updating the protocol fee rate, the previous liquidity rate must be applied to the previous time delta first.(the relation between protocol fee rate and liquidty rate can be seen in the calculateLiquidtyRate in the reserveLibrary.sol)

Impact

loss of funds for the protocol or the users depending on the direction of change of the protocol fee rate

Tools Used

manual review

Recommendations

update the interest first before changing the protocol fee rate.