bareli - calculateCompoundedInterest will revert

[sherlock-admin3]

bareli

Medium

calculateCompoundedInterest will revert

Summary

lets take raye as 10^27 then when we create the basePowerThree = basePowerTwo.rayMul(rate) / SECONDS_PER_YEAR;

we ill be getting around 10^80 which is more than unit256.max so calculateCompoundedInterest will revert.

Vulnerability Detail

function calculateCompoundedInterest(uint256 rate, uint40 lastUpdateTimestamp, uint256 currentTimestamp) internal pure returns (uint256) { //solium-disable-next-line uint256 exp = currentTimestamp - uint256(lastUpdateTimestamp);

if (exp == 0) {
  return WadRayMath.RAY;
}

uint256 expMinusOne;
uint256 expMinusTwo;
uint256 basePowerTwo;
uint256 basePowerThree;
unchecked {
  expMinusOne = exp - 1;

  expMinusTwo = exp > 2 ? exp - 2 : 0;

  basePowerTwo = rate.rayMul(rate) / (SECONDS_PER_YEAR * SECONDS_PER_YEAR);
  basePowerThree = basePowerTwo.rayMul(rate) / SECONDS_PER_YEAR;
}

uint256 secondTerm = exp * expMinusOne * basePowerTwo;
unchecked {
  secondTerm /= 2;
}

@>> uint256 thirdTerm = exp expMinusOne expMinusTwo * basePowerThree; unchecked { thirdTerm /= 6; }

return WadRayMath.RAY + (rate * exp) / SECONDS_PER_YEAR + secondTerm + thirdTerm;

}

Impact

calculateCompoundedInterest will revert.

Code Snippet

https://github.com/sherlock-audit/2024-06-new-scope/blob/main/zerolend-one/contracts/core/pool/utils/MathUtils.sol#L83

Tool used

Manual Review

Recommendation

change uint256 internal constant SECONDS_PER_YEAR = 365 243600;

[nevillehuang]

Invalid, unrealistic values with no concrete examples given