c4-bot-4 commented 1 month ago

Lines of code

https://github.com/code-423n4/2024-07-benddao/blob/main/src/libraries/logic/ConfigureLogic.sol#L526 https://github.com/code-423n4/2024-07-benddao/blob/main/src/libraries/logic/ConfigureLogic.sol#L626

Vulnerability details

Impact

After updating the interest model, the protocol does not update the interest rate, resulting in interest being calculated at the old model rates for some time.

Proof of Concept

The pool admin can change rate model in the Configurator.sol module:

  function executeSetAssetLendingRate(
    address msgSender,
    uint32 poolId,
    address asset,
    uint8 groupId,
    address rateModel_
  ) internal {
    DataTypes.PoolStorage storage ps = StorageSlot.getPoolStorage();

    require(groupId >= Constants.GROUP_ID_LEND_MIN, Errors.INVALID_GROUP_ID);
    require(groupId <= Constants.GROUP_ID_LEND_MAX, Errors.INVALID_GROUP_ID);
    require(rateModel_ != address(0), Errors.INVALID_ADDRESS);

    DataTypes.PoolData storage poolData = ps.poolLookup[poolId];
    _validateCallerAndPool(msgSender, ps, poolData);

    DataTypes.AssetData storage assetData = poolData.assetLookup[asset];
    require(assetData.underlyingAsset != address(0), Errors.ASSET_NOT_EXISTS);
    require(assetData.assetType == Constants.ASSET_TYPE_ERC20, Errors.ASSET_TYPE_NOT_ERC20);

    require(assetData.groupList.contains(groupId), Errors.GROUP_NOT_EXISTS);

    DataTypes.GroupData storage groupData = assetData.groupLookup[groupId];
>>  groupData.rateModel = rateModel_;

    emit Events.SetAssetLendingRate(poolId, asset, groupId, rateModel_);
  }

However, interest rate is not updated, meaning interest will be calculated with the cached old model rates until InterestLogic.updateInterestRates is finally called.

Tools Used

Manual review

Recommended Mitigation Steps

    ---SNIP---

    DataTypes.GroupData storage groupData = assetData.groupLookup[groupId];
    groupData.rateModel = rateModel_;
+   InterestLogic.updateInterestRates(poolData, assetData, 0, 0)

    emit Events.SetAssetLendingRate(poolId, asset, groupId, rateModel_);
  }