Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect return value in ReserveLibrary::getNormalizedDebt causing inaccurate debt calculation

freesultan

Summary

The getNormalizedDebt function returns an incorrect value when timeDelta equals zero. This leads to an incorrect calculation of the normalized debt, potentially causing inconsistencies in the protocol's financial operations.

Vulnerability Details

The ReserveLibrary::getNormalizedDebt function is intended to return the updated reserve.usageIndex variable. However, in the case where timeDelta equals zero, it incorrectly returns the reserve.totalUsage variable instead of the reserve.usageIndex.

function getNormalizedDebt(ReserveData storage reserve, ReserveRateData storage rateData) internal view returns (uint256) {
uint256 timeDelta = block.timestamp - uint256(reserve.lastUpdateTimestamp);
if (timeDelta < 1) {
return reserve.totalUsage;
}
return calculateCompoundedInterest(rateData.currentUsageRate, timeDelta).rayMul(reserve.usageIndex);
}

Impact

Returning reserve.totalUsage instead of reserve.usageIndex when timeDelta is zero results in an inaccurate debt calculation.

Tools Used

Manual code review

Recommendations

modify the function to return reserve.usageIndex when timeDelta is zero:

function getNormalizedDebt(ReserveData storage reserve, ReserveRateData storage rateData) internal view returns (uint256) {
uint256 timeDelta = block.timestamp - uint256(reserve.lastUpdateTimestamp);
if (timeDelta < 1) {
- return reserve.totalUsage;
+ return reserve.usageIndex;
}
return calculateCompoundedInterest(rateData.currentUsageRate, timeDelta).rayMul(reserve.usageIndex);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

getNormalizedDebt returns totalUsage (amount) instead of usageIndex (rate) when timeDelta < 1, breaking interest calculations across the protocol

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

getNormalizedDebt returns totalUsage (amount) instead of usageIndex (rate) when timeDelta < 1, breaking interest calculations across the protocol

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.