012.md

Obedient Lava Monkey

Medium

Improper Clearing of Unused Bits Causes Incorrect Reserve Configuration

Summary

In ReserveConfiguration.sol, improper clearing of unused bits when introducing new configuration logic will cause configuration corruption for users and protocol operations as existing residual data in unused bit regions can result in misconfigured parameters.

Root Cause

In ReserveConfiguration.sol, the unused bits (e.g. bits 168-176) are not explicitly cleared during updates. Example code:

• In ReserveConfiguration.sol, bits 168-176, previously unoccupied (eModeCategory), are not cleared when reused.

Internal Pre-conditions

1. A developer introduces new logic or parameters that use previously unused bits (e.g., 168-176).
2. The protocol does not explicitly clear the residual data in these bits.

External Pre-conditions

1. The protocol relies on existing configuration data stored in self.data.
2. Residual data exists in the unused bits (e.g. from a past version of the protocol or an invalid state).

Attack Path

1. An admin updates the reserve configuration using setParams() or setCaps() without clearing unused bits.
2. Corrupted data in unused bits interacts with new logic introduced by the update.
3. The corrupted configuration leads to inconsistent reserve parameters, such as unexpected eModeCategory or invalid Liquidation Bonus.

Impact

The protocol suffers a potential loss of consistency in reserve parameters, which could result in:

• Invalid calculations for loan-to-value, liquidation bonus, or debt ceilings.
• Unintended consequences such as enabling borrowing or supplying for restricted assets

PoC

No response

Mitigation

Always explicitly clear unused bits before updating new parameters:

self.data &= ~(MASK_FOR_UNUSED_BITS);