Submitted by bin2chen, also found by oakcobalt
In executeYieldBorrowERC20(), we will check whether stakerAddr exceeds yieldCap.
The code above, calculating totalSupply using totalSupply = totalScaledCrossSupply * groupData.borrowIndex to calculate supply is wrong. The correct way to calculate supply is to use: assetData.supplyIndex.
With an incorrect value for totalSupply, the check for yieldCap will be inaccurate, leading to a security risk.
Context
thorseldon (BendDAO) confirmed and commented:
