Core Contracts

Summary

The function _rebalanceLiquidity in LendingPool.sol emits the LiquidityRebalanced event at the end of the function execution, even if no rebalancing action is performed. This happens when the currentBuffer and desiredBuffer are already equal, leading to the emission of an event that does not reflect an actual state change.

Vulnerability Details

The issue lies in the logic of the _rebalanceLiquidity function. The function emits the LiquidityRebalanced event regardless of whether the liquidity rebalancing actually occurred. The event is emitted at the end of the function, even when the currentBuffer and desiredBuffer values are identical, meaning no deposits or withdrawals are made. This could result in misleading logs and unnecessary gas usage, as the event does not represent any change in liquidity.

This line is executed even when no rebalance is needed (i.e., when currentBuffer == desiredBuffer), which is unnecessary.

Impact

This could lead to:

• Unnecessary gas costs - Emitting events consumes gas, and emitting an event when no action is taken wastes gas.

• Misleading event logs - External systems or users monitoring the events might assume that rebalancing has occurred when, in reality, it has not, leading to potential confusion.

Tools Used

Manual code review

Recommended Mitigation

The emission of the LiquidityRebalanced event should be conditioned on the occurrence of an actual rebalance action. This can be achieved by checking if the currentBuffer differs from the desiredBuffer before emitting the event. The following modification is suggested:

This ensures that the event is only emitted when there is an actual liquidity rebalance, thereby reducing unnecessary gas consumption and ensuring more accurate logs.