You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Therefore, calling the updateInterestRates() function before repayDebt() means that the un-deducted debt shares value is used to calculate the new interest rate, which will make a position to keep higher borrow rate till the next call.
Impact
The updating borrow interest rate with un-deducted debt shares will accrue the borrow index with the higher borrow rate till the next call.
Thus, a borrower or repayer of the next call will have to pay higher assets than expected, and such over-paying will decrease pool users' incentives.
sherlock-admin3
changed the title
Big Admiral Dove - The repaying function calculates interest rates with un-updated total debts values
stuart_the_minion - The repaying function calculates interest rates with un-updated total debts values
Oct 3, 2024
stuart_the_minion
Medium
The repaying function calculates interest rates with un-updated total debts values
Summary
The Repaying function calculates interest rates with out-of-date total debts value
Vulnerability Detail
The interest rates updating step should be done as post-payment process for all pool operations except for flash loaning. (Check this comment)
Updating interest rates as a post-payment process facilitates reserves accruing borrow index with the latest borrow rate till the next pool operation.
And, as can be seen from the code snippet below, the
updateInterestRates()
function requires updated debt shares to calculate the borrow and interest.Meanwhile, the
repayDebt()
function subtracts debt shares from the total and position debt shares in proportion to the repaid assets amount.Therefore, calling the
updateInterestRates()
function beforerepayDebt()
means that the un-deducted debt shares value is used to calculate the new interest rate, which will make a position to keep higher borrow rate till the next call.Impact
The updating borrow interest rate with un-deducted debt shares will accrue the borrow index with the higher borrow rate till the next call.
Thus, a borrower or repayer of the next call will have to pay higher assets than expected, and such over-paying will decrease pool users' incentives.
Code Snippet
pool/logic/BorrowLogic.sol#L139-L152
Tool used
Manual Review
Recommendation
The
updateInterestRates()
function call should go afterrepayDebt()
:Duplicate of #413
The text was updated successfully, but these errors were encountered: