Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

getNormalizedDebt and getNormalizedIncome will return stale indices

anonymousjoe

Summary

Whenever the getNormalizedDebt/income is called the current value in the reserve.usageIndex is returned. This is wrong since the usageIndex changes according to time and should be updated before returning.

Vulnerability Details

It can be seen that the liquidty index depends on the time linearly (and the borrow index exponentially). So whenever the getNormalizedIncome (or getNormalizedDebt) is called, the value must be updated before returning reserve.usageIndex. Else the stale value will be returned. This causes issues everywhere that usageIndex/liquidityIndex is used externally. For example: in the emission rate calculation in the stabilityPool, the normalizedDebt is used which will cause an incorrect amount of RAAC token emitted thus resulting in incorrect rewards being distributed.

function getNormalizedIncome() external view returns (uint256) {
return reserve.liquidityIndex;
}
function calculateLiquidityIndex(uint256 rate, uint256 timeDelta, uint256 lastIndex) internal pure returns (uint128) {
uint256 cumulatedInterest = calculateLinearInterest(rate, timeDelta, lastIndex);
return cumulatedInterest.rayMul(lastIndex).toUint128();
}

Impact

many impacts are present, one of them is the incorrect RAAC tokens distributed as rewards in the stabilityPool

Tools Used

manual review

Recommendations

Update the usageindex and liquidity index in the get functions before returning them.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::getNormalizedIncome() and getNormalizedDebt() returns stale data without updating state first, causing RToken calculations to use outdated values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.