In the LendingPool's deposit function, the amount provided in crvUSD (18 decimals) is passed directly to RToken's mint function where it's used in RAY math operations (27 decimals) without proper scaling, leading to significant precision loss or failed mints.
When a user deposits crvUSD through the LendingPool:
This amount is then passed to RToken's mint function:
The issue arises because:
amountToMint is in crvUSD decimals (1e18)
index is in RAY precision (1e27)
The rayDiv
operation expects both operands to be in RAY precision
The division results in a very small number (1e-9) due to decimal mismatch
Significant loss of precision in minted RToken amounts
Potential revert of mint operations if amountScaled rounds to 0
Inconsistent minting behavior for different deposit sizes
This could lead to:
Users receiving far fewer RTokens than they should
Failed deposits for smaller amounts
Accounting errors in the protocol
Manual Review
Scale the deposit amount to RAY precision before performing RAY math operations:
Alternative approach:
This ensures all RAY math operations are performed with correctly scaled values, preventing precision loss and maintaining consistent behavior across different deposit sizes.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.