The discount lock-period of user can be bypassed by executing balance-changing actions

[Michael Morami]

In GhoVariableDebtToken.sol, the rebalanceUserDiscountPercent function checks a user's rebalance lock period (rebalanceTimestamp) is over before it allows rebalancing of the discount percentage.

• The requirement checking the rebalancing lock period is over
• The actual update of the percentage rate

However, _burnScaled and _mintScaled, stkAAVE.transfer are doing the same functionality of updating the discount percentage without checking whether the lock period is over.

• mint call to update
• burn call to update
• stkAAVE call to updateDistribution, and updateDistribution call to update discount percentage

This allows a user to rebalance their own, or somebody else's discount percentage even when the lock period is still active.

[Mark Hinschberger]

Link T-5682