Core Contracts

Summary

The updateLiquidityIndex function in the RToken contract contains an off-by-one error in its validation check. The current implementation allows an update when the new liquidity index is equal to the current one, even though the intended behavior is to update only if the new index is strictly greater.

Vulnerability Details

In the updateLiquidityIndex function, the liquidity index is updated with the following check:

The check currently reverts only if newLiquidityIndex is less than _liquidityIndex. However, the audit comment indicates that the function should also reject updates where newLiquidityIndex is equal to _liquidityIndex—that is, the new index should be strictly greater than the current index. Allowing an update with an unchanged liquidity index may lead to unnecessary state changes and misleading event emissions.

Impact

• Unnecessary State Updates:
  Allowing an update when the liquidity index is equal to the current value results in redundant state changes and event emissions, which may confuse off-chain monitoring and analytics systems.

Tools Used

• Manual code review

Recommended Mitigation

Modify the validation check to ensure that the new liquidity index is strictly greater than the current index. For example, update the condition as follows: