Core Contracts

Summary

The burn function executes but contains two key issues:

1. Incorrect amount scaling when burning tokens

2. Return values don't match parameter order

Vulnerability Details

[](https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/RToken.sol#L164C9-L184C48)

RToken::burn burns tokens based on the liquidityIndex to account for accrued interest. As interest accrues (liquidityIndex > 1), fewer rTokens should be burned to receive the same underlying amount, reflecting their increased value.

The implementation has three issues:

1. Incorrect scaling:

Using rayMul instead of rayDiv inflates the burn amount.

Example:

• Initial: 50 underlying = 50 rTokens (index = 1.0)

• After interest: 50 underlying should = 45.45 rTokens (index = 1.1)

• Current code burns 55 rTokens (50 * 1.1)

The current implementation:

1. Uses rayMul instead of rayDiv, scaling up instead of down

2. Burns raw amount instead of scaled amount

3. Returns wrong scaled value

4. Burns unscaled amount:

1. Returns amount in first parameter when it should be amountScaled

The order is wrong, we're returning the unscaled amount for the first parameter which is supposed to be the scaled tokens burned per natspec.

Impact

• Incorrect burn amounts lead to value loss for users when interest has accrued

• Inaccurate return values break protocols integrating with burn function

Tools Used

Foundry

Recommendations