Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Borrowers Do Not Pay `balanceIncrease` in `LendingPool._repay()`

gajiknownnothing

Summary

The DebtToken.burn() function returns the balanceIncrease, which represents the accrued borrow fees. However, the LendingPool._repay() function only requires borrowers to repay the burned debt amount (amount) and does not account for the balanceIncrease. This allows borrowers to avoid paying borrow fees, resulting in a loss of revenue for the protocol.

Vulnerability Details

The DebtToken.burn() function calculates the balanceIncrease, which represents the accrued borrow fees due to interest.

However, the LendingPool._repay() function only requires borrowers to repay the amount (burned debt amount) and ignores the balanceIncrease.

This allows borrowers to repay their debt without paying the accrued borrow fees, effectively bypassing the protocol's fee mechanism.

DebtToken.burn():

193: uint256 balanceIncrease = 0;
194: if (_userState[from].index != 0 && _userState[from].index < index) {
195: uint256 borrowIndex = ILendingPool(_reservePool).getNormalizedDebt();
196: balanceIncrease = userBalance.rayMul(borrowIndex) - userBalance.rayMul(_userState[from].index);
197:> amount = amount;
198: }
...
210: _burn(from, amount.toUint128());
211: emit Burn(from, amountScaled, index);
212:
213:> return (amount, totalSupply(), amountScaled, balanceIncrease);

LendingPool._repay()https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L418-L422

Impact

Borrowers benefit from not paying the fees they owe.

Tools Used

vscode

Recommendations

Update the LendingPool._repay() function to include the balanceIncrease in the repayment amount. Borrowers should repay both the principal (amount) and the accrued fees (balanceIncrease).

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken::burn calculates balanceIncrease (interest) but never applies it, allowing borrowers to repay loans without paying accrued interest

Interest IS applied through the balanceOf() mechanism. The separate balanceIncrease calculation is redundant/wrong. Users pay full debt including interest via userBalance capping.

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken::burn calculates balanceIncrease (interest) but never applies it, allowing borrowers to repay loans without paying accrued interest

Interest IS applied through the balanceOf() mechanism. The separate balanceIncrease calculation is redundant/wrong. Users pay full debt including interest via userBalance capping.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.