Permanent Interest Freeze via maxRate and elapsed Manipulation
https://github.com/morpho-org/vault-v2/blob/main/src/VaultV2.sol#L430
Solidity
uint256 maxTotalAssets = _totalAssets + (_totalAssets * elapsed).mulDivDown(maxRate, WAD);
uint256 newTotalAssets = MathLib.min(realAssets, maxTotalAssets);
Description
Morpho uses a maxRate to prevent sudden jumps in share price (e.g., from donations). However, if the maxRate is set very low or if _totalAssets * elapsed is small (e.g., due to very frequent pings/accruals), the term (_totalAssets * elapsed).mulDivDown(maxRate, WAD) can consistently round down to zero. An attacker can call any public function that triggers accrueInterest() multiple times within a short period, ensuring elapsed is always small enough that no interest is ever recognized by the vault.
Impact
High. Yield Denial of Service. This prevents the vault from realizing legitimate interest earned from adapters. The interest remains "trapped" in the adapters because the vault's internal _totalAssets accounting never increases, effectively denying depositors their yield.
0 条评论