Core Contracts

Summary

The ReserveLibrary#setPrimeRate() updates the primeRate but does not update the dependent rates (baseRate, optimalRate, maxRate). Since these values are calculated based on primeRate in LendingPool's constructor, but not updated when primeRate changes, the borrow rate calculation can become inconsistent or incorrect.

Vulnerability Details

LendingPool#setPrimeRate() is called by oracle and it is perfomed by ReserveLibrary#setPrimeRate()

But in this function(), only primeRate is updated and other relation rates(baseRate, optimalRate, maxRate) are not updated.

As seen above in LendingPool's constructor, when primeRate is set, other rates are updated based on this value.

There's no set function in this protocol.

Since calculateBorrowRate() still uses old baseRate, optimalRate, and maxRate values, it results in incorrect borrow rate calculations.

This can cause:

• Undercharging borrowers, leading to reduced lending pool earnings.

• Overcharging borrowers, making borrowing unattractive or unprofitable.

• Unintended behavior in interest rate adjustments.

Impact

Financial imbalance in the lending pool: Borrowers may pay less or more than intended, affecting the sustainability of the protocol.

It will lead to potential loss of liquidity. If borrowing is too cheap, bad debt increases; if too expensive, demand decreases.

Tools Used

manual

Recommendations

Update dependent rates inside ReserveLibrary#setPrimeRate() same as LendingPool's constructor.

function setPrimeRate(
ReserveData storage reserve,
ReserveRateData storage rateData,
uint256 newPrimeRate
) internal {
if (newPrimeRate < 1) revert PrimeRateMustBePositive();

}