momo - Interest calculation

[sherlock-admin3]

momo

Medium

Interest calculation

Summary

interest accrued by totalBorrowAsset is the amount to pay back while interest by

     totalSupplyAsset is the amount gained by providing liquidity to the pool, however, 
     the function expectedMarketBalances uses the interest of only market.totalBorrowAssets 
     to calculate the interest of both market.totalBorrowAssets and  market.totalSupplyAssets in  
    line 45-47
        uint256 borrowRate = IIrm(marketParams.irm).borrowRateView(marketParams, market);
        uint256 interest = market.totalBorrowAssets.wMulDown(borrowRate.wTaylorCompounded(elapsed));
        market.totalBorrowAssets += interest.toUint128();
        market.totalSupplyAssets += interest.toUint128();

The calculated interest is then added to both totalBorrowAssets and totalSupplyAssets.

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

mplications of This Logic
Incorrect Interest Attribution:
interest accrued on borrowed assets should not directly affect the total supply asset as they are distinct actions
with different risk profiles and financial implications.
Interest on borrow assets represents a cost to borrowers, while interest on supply assets
represents earnings for the liquidity provider of that position.
If both totalBorrowAssets and totalSupplyAssets are updated with the same interest amount, it could lead to misleading balances.

Risk of Economic Exploitation:
If users understand that they can manipulate the system by borrowing and causing inflated supply balances through this logic, it could lead to economic exploits or unintended consequences in how liquidity is managed within the platform.

Recommendations
Separate Interest Calculations:
Implement distinct calculations for interest on borrowed assets and supplied assets.
Clear Documentation:
Document how interest is calculated and attributed within the protocol clearly so that users understand how their balances are determined.

PoC

No response

Mitigation

No response