FLO-2: setInsuranceRate() and setStabilityFeeRate() Retroactively Applies New Rates and Fails to Update Interest Rates #211

Severity: High

Files Affected

• cadence/contracts/FlowALPv1.cdc

Description

The protocol calculates insurance fees within the collectInsurance() function by multiplying the token's debt income by the current insuranceRate over the time elapsed since lastInsuranceCollectionTime. However, when governance updates the rate via Pool.setInsuranceRate() and Pool.setStabilityRate(), the function simply updates the state variable. It completely fails to trigger a fee collection or reset the lastInsuranceCollectionTimeand lastStabilityFeeCollectionTime timestamp. Because the timestamp remains unchanged, the next time an operation triggers collection, the newly configured insuranceRate and stabilityRate will be mathematically applied to the entire time elapsed since the last collection, retroactively overcharging or undercharging the protocol's reserves. Additionally, it fails to trigger updateInterestRates() after the change. This leaves the currentCreditRate stale, meaning the protocol will continue paying lenders at the old rate while simultaneously charging the new insurance rate and stability rate, creating a systemic accounting deficit. Exploit Scenario:

• Governance sets a token's insuranceRate to 0.0, and the protocol operates normally for six months without collecting any insurance fees.
• Governance decides to enable insurance and calls setInsuranceRate() to change the rate to 5% (0.05).
• The setInsuranceRate() function updates the rate but does not update the lastInsuranceCollectionTime timestamp, which remains set to a date six months in the past.
• The next time a user interacts with the pool and triggers updateInterestRatesAndCollectInsurance(), the protocol calculates the fee using the new 5% rate over the entire six-month period.
• A massive, unwarranted fee is retroactively extracted from the reserves and swapped to MOET, severely damaging the utilization and yield calculations of the protocol.

Recommendation

Force an interest rate update and insurance and stability collection before applying the new rate. This ensures that all previously accrued time is processed accurately under the old rate, and the lastInsuranceCollectionTime and lastStabilityFeeCollectionTime is updated to the current block timestamp so the new rate only applies moving forward.

Parent Issue: #209