Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

LendingPool: Lenders Lose their assets Upon Withdrawal

ace_30

Summary

When users deposit money into the lending pool, they should earn interest over time. However, due to a mistake in the withdraw users get less than their deposited assets, without any interest.

Vulnerability Details

Bug Scenario:

  1. A user deposits 100 assets into the pool when lendingIndex = 2

    1. He receives 100 / 2 = 50 RTokens (User balance = 50 RTokens).

  2. The user calls withdraw(50).

    1. It calls RToken.burn(amount=50).

    2. Inside burn() function:

      1. _burn(amount=50) is called, which burns the entire user balance (50 RTokens).

      2. 50 assets are transferred back to the user

  3. So It burns 50 tokens and transfers 50 assets to user ignoring the index scaling

As a result, the user deposited 100 assets and only can withdraw 50 assets.

Impact

Lenders lose their assets when they deposit into LendingPool and withdraw

Tools Used

vscode

Recommendations

inside RToken.burn function, burn amount/index of RTokens:

function burn(
address from,
address receiverOfUnderlying,
uint256 amount,
uint256 index
) external override onlyReservePool returns (uint256, uint256, uint256) {
--snip--
- uint256 amountScaled = amount.rayMul(index);
+ uint256 amountScaled = amount.rayDiv(index);
​
- _burn(from, amount.toUint128());
+ _burn(from, amountScaled.toUint128());
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::burn incorrectly calculates amountScaled using rayMul instead of rayDiv, causing incorrect token burn amounts and breaking the interest accrual mechanism

RToken::burn incorrectly burns amount (asset units) instead of amountScaled (token units), breaking token economics and interest-accrual mechanism

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::burn incorrectly calculates amountScaled using rayMul instead of rayDiv, causing incorrect token burn amounts and breaking the interest accrual mechanism

RToken::burn incorrectly burns amount (asset units) instead of amountScaled (token units), breaking token economics and interest-accrual mechanism

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.