Submission Details
Severity:
Wrong event emitted in `LendingPool::_repay`
Summary
The LendingPool::_repay function emits a Repay event that, according to its natspec documentation, should contain "The amount repaid"). However, the implementation uses actualRepayAmount (an unscaled value calculated before the burn) instead of amountScaled (the actual amount that was repaid).
Vulnerability Details
function _repay(uint256 amount, address onBehalfOf) internal {
if (amount == 0) revert InvalidAmount();
if (onBehalfOf == address(0)) revert AddressCannotBeZero();
...omitted code
// If amount is greater than userDebt, cap it at userDebt
@> uint256 actualRepayAmount = amount > userScaledDebt ? userScaledDebt : amount;
uint256 scaledAmount = actualRepayAmount.rayDiv(reserve.usageIndex);
... omitted code
@> emit Repay(msg.sender, onBehalfOf, actualRepayAmount);
}
Impact
Off-chain systems and front-end monitoring this event will receive and process incorrect amount values, leading to inaccurate accounting or wrong display returned to users of the repaied amounts.
Tools Used
Manual review
Recommendations
Modify the event emission to use the actual amount that was repaid.
function _repay(uint256 amount, address onBehalfOf) internal {
if (amount == 0) revert InvalidAmount();
if (onBehalfOf == address(0)) revert AddressCannotBeZero();
... omitted code
// Update liquidity and interest rates
ReserveLibrary.updateInterestRatesAndLiquidity(reserve, rateData, amountScaled, 0);
- emit Repay(msg.sender, onBehalfOf, actualRepayAmount);
+ emit Repay(msg.sender, onBehalfOf, actualScaled);
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::_repay emits Repay event with capped actualRepayAmount instead of the real amountScaled value that was transferred, causing misleading event data
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::_repay emits Repay event with capped actualRepayAmount instead of the real amountScaled value that was transferred, causing misleading event data
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.