ITADN

Permanent Interest Freeze via maxRate and elapsed Manipulation

#876Opengelenbedalen-art 创建于 2026-01-06
https://github.com/morpho-org/vault-v2/blob/main/src/VaultV2.sol#L430 Solidity uint256 maxTotalAssets = _totalAssets + (_totalAssets * elapsed).mulDivDown(maxRate, WAD); uint256 newTotalAssets = MathLib.min(realAssets, maxTotalAssets); Description Morpho uses a maxRate to prevent sudden jumps in share price (e.g., from donations). However, if the maxRate is set very low or if _totalAssets * elapsed is small (e.g., due to very frequent pings/accruals), the term (_totalAssets * elapsed).mulDivDown(maxRate, WAD) can consistently round down to zero. An attacker can call any public function that triggers accrueInterest() multiple times within a short period, ensuring elapsed is always small enough that no interest is ever recognized by the vault. Impact High. Yield Denial of Service. This prevents the vault from realizing legitimate interest earned from adapters. The interest remains "trapped" in the adapters because the vault's internal _totalAssets accounting never increases, effectively denying depositors their yield.
0 条评论