`borrowRatePerBlock()` and `supplyRatePerBlock()` may not return correct values.

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/lending/tokens/cToken/CTokenModified.sol#L254 https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/lending/tokens/cToken/CTokenModified.sol#L267

Vulnerability details

Impact

borrowRatePerBlock() may return an incorrect value, as totalBorrows may not be up to date : that is, if accrueInterest() was called N >= 1 blocks before the call to borrowRatePerBlock().

Rated as medium as external dApps may call borrowRatePerBlock() and have built-in logic to borrow depending on the value of the returned interest rate.

Proof of Concept

• protocol ABC wishes to lend DAI to protocol XYZ, where the lending interest rate is N
• they want to borrow DAI from Flux, but only if the borrowing interest rate is less than the lending interest rate on XYZ (to make it profitable)
• a function call is made in protocol ABC, which first calls borrowRatePerBlock to check whether the current per-block borrowing interest rate is less than N (to see whether it is profitable to borrow from Flux).
• borrowRatePerBlock returns M < N, so the protocol call goes through by calling borrow(), then lends this amount to XYZ.
• The problem is that upon borrowing, the borrowing interest was updated to be L > N, making this whole operation non-profitable for ABC.

This would not have happened if the interest had been updated in borrowRatePerBlock.

Tools Used

Manual review

Recommended Mitigation Steps

Add a accrueInterest() call at the start of borrowRatePerBlock() and supplyRatePerBlock()

[trust1995]

We can see that Compound doesn't do it either: https://github.com/compound-finance/compound-protocol/blob/a3214f67b73310d547e00fc578e8355911c9d376/contracts/CToken.sol Will treat as more of a suggestion.

[c4-judge]

Duplicate of https://github.com/code-423n4/2023-01-ondo-findings/issues/341

[c4-judge]

trust1995 marked the issue as grade-b

[c4-judge]

trust1995 marked the issue as grade-a