Core Contracts

Summary

The DebtToken.balanceOf() function doesn't return the exact debt amount of the user, as it fails to account for the increased debt balance generated by the usage index delta between the global usage index and the user's index.

Vulnerability Details

The DebtToken.balanceOf() function doesn't account for the increased balance generated by the usage index update.

Over time, the global usage index increases. In the DebtToken logic, for every update for users, the users' indices are updated by the global usage index, and the users' debt balance is increased by the index delta between the global index and the users' index. This can be observed in the functions mint() and burn().

However, the balanceOf() function does not account for this increased balance, resulting in an incorrect return value.

Impact

balanceOf() returns an incorrect value that does not reflect the increased balance by the index delta.

Tools Used

Manual review

Recommendations

Account for the increased balance by the index delta.