Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: high
Valid

Double Liquidity Index Scaling in RToken.sol Transfer Functions Leads to Incorrect Token Amounts

Summary

The RToken.sol contract's transfer() and transferFrom() functions incorrectly scale token amounts twice by the liquidity index when performing transfers. This occurs because both the transfer function and the internal _update function independently apply the same scaling operation, resulting in token amounts being divided by the liquidity index twice.

Vulnerability Details

The issue arises from the interaction between the transfer functions and the _update function.

When a transfer is initiated:

<= This is Correct

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}

But then, this scaled amount is passed to _update and divided by the Liquidity Index again:

function _update(address from, address to, uint256 amount) internal override {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

As a result, the user would transfer:

Impact

Low - Transferring incorrect token amounts, significantly less than intended. However, user doesn't lose funds therefore low impact.

Likelihood

High - This issue would be triggered by every transfer operation, affecting all users of the protocol who attempt to transfer tokens.

Severity

Low x High = Medium overall

Proof of Concept

Sufficient information has been provided.

Recommendations

Remove the scaling operation from the transfer and transferFrom functions, keeping it only in _update.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.