_usageIndex in the DebtToken contract will not always fetch the latest Reserve Usage Index
Summary
_usageIndex will remain 1e27 in the DebtToken contract even when the value changes in the LendingPool reserve.
Vulnerability Details
The _usageIndex variable is designed for tracking the latest value of the reserve pool usage index. There is only one privileged function in the contract to update this variable. This is the updateUsageIndex with the onlyReservePool modifier. On thorough observation of the Lending Pool to detect when these updates will be made, there is no function that can be triggered on the pool to make the reservePool update the value.
Impact
_usageIndex will be inconsistent with returning value from the reserve pool.
Tools Used
Manual review.
Recommendations
Design the _usageIndex in DebtToken to fetch accurate usageIndex from reserve pool.
Lead Judging Commences
[INVALID] Unused _usageIndex Variable and updateUsageIndex() Function in DebtToken Contract
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.