You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
Pool Admin when updates the reserve strategy will mix indexes and rates affecting 7 pool operations
Summary
Mixed liquidityIndex and borrowIndex will cause 7 important operations in zaros not to work properly as pool admin will change the interest rate strategy of a reserve but the problem is that it doesn't update properly for the old strategy before updating the new one.
PoolConfigurator::setReserveInterestRateStrategyAddress is used to change the interest rate strategy for a reserve of a pool at any time. However before applying the change the interest should accrue for the old strategy to avoid inconsistencies in most of the critical operation of Zerolend over the affected pool:
Operation
Reason
Accrue To Treasury
Mixed borrowIndex
Borrow
Mixed borrowIndex
Repay
Mixed borrowIndex
Flashloan
Mixed liquidityIndex
Liquidation
Mixed Both borrowIndex and liquidationIndex
Supply
Mixed liquidityIndex
Withdraw
Mixed liquidityIndex
Root Cause
PoolConfigurator.sol:105 setReserveInterestRateStrategyAddress change one strategy for another updating the field interestRateStrategyAddress, then is used in ReserveLogic::updateInterestRates to update _reserve.liquidityRate and _reserve.borrowRate. Those 2 fields are use then by ReserveLogic::updateState to update the borrowIndex and the liquidityIndex in a **time range [lastUpdateTimestamp, now]**The time range is important. The problem is that the time range will be t0 + t1 where t0 has liquidityRate and borrowRate from the old strategy and t1 liquidityRate and borrowRate from the new strategy leading to inconsistencies in most of the operation of zerolend.
Pool Admin needs to call PoolConfigurator::setReserveInterestRateStrategyAddress
External pre-conditions
None
Attack Path
User Creates Pool
Admin pool update an interest strategy address as result each liquidityIndex and borrowIndex will be mixed.
Impact
liquidityIndex and borrowIndex will be incorrect as will be a result of a mixing rates of the old reserve strategy and the new one leading to 7 pool operations working with incorrect values:
Accrue To Treasury
Borrow
Repay
Flashloan
Liquidation
Supply
Withdraw
PoC
No response
Mitigation
Update indexes and Rates before updating the new interest strategy using:
The flow (cache -> updateState -> updateInterestRates)
sherlock-admin3
changed the title
Massive Nylon Vulture - Pool Admin when updates the reserve strategy will mix indexes and rates affecting 7 pool operations
nfmelendez - Pool Admin when updates the reserve strategy will mix indexes and rates affecting 7 pool operations
Oct 3, 2024
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
nfmelendez
Medium
Pool Admin when updates the reserve strategy will mix indexes and rates affecting 7 pool operations
Summary
Mixed
liquidityIndex
andborrowIndex
will cause 7 important operations in zaros not to work properly as pool admin will change the interest rate strategy of a reserve but the problem is that it doesn't update properly for the old strategy before updating the new one.PoolConfigurator::setReserveInterestRateStrategyAddress
is used to change the interest rate strategy for a reserve of a pool at any time. However before applying the change the interest should accrue for the old strategy to avoid inconsistencies in most of the critical operation of Zerolend over the affected pool:borrowIndex
borrowIndex
borrowIndex
liquidityIndex
borrowIndex
andliquidationIndex
liquidityIndex
liquidityIndex
Root Cause
PoolConfigurator.sol:105 setReserveInterestRateStrategyAddress
change one strategy for another updating the fieldinterestRateStrategyAddress
, then is used inReserveLogic::updateInterestRates
to update_reserve.liquidityRate
and_reserve.borrowRate
. Those 2 fields are use then byReserveLogic::updateState
to update theborrowIndex
and theliquidityIndex
in a **time range [lastUpdateTimestamp, now]**The time range is important. The problem is that the time range will be t0 + t1 where t0 has liquidityRate and borrowRate from the old strategy and t1 liquidityRate and borrowRate from the new strategy leading to inconsistencies in most of the operation of zerolend.https://github.com/sherlock-audit/2024-06-new-scope/blob/main/zerolend-one/contracts/core/pool/manager/PoolConfigurator.sol#L105-L111
https://github.com/sherlock-audit/2024-06-new-scope/blob/main/zerolend-one/contracts/core/pool/logic/PoolLogic.sol#L150
Internal pre-conditions
PoolConfigurator::setReserveInterestRateStrategyAddress
External pre-conditions
None
Attack Path
Impact
liquidityIndex
andborrowIndex
will be incorrect as will be a result of a mixing rates of the old reserve strategy and the new one leading to 7 pool operations working with incorrect values:PoC
No response
Mitigation
Update indexes and Rates before updating the new interest strategy using:
The flow (cache -> updateState -> updateInterestRates)
Duplicate of #401
The text was updated successfully, but these errors were encountered: