Core Contracts

Summary

The _mint() and _burn() functions in both RToken and DebtToken convert amount from uint256 to uint128 using .toUint128().

If amount > uint128.max, this causes a silent truncation, potentially leading to incorrect balance tracking.

This happens in ReserveLibrary#updateInterestRatesAndLiquidity(), where liquidityAdded and liquidityTaken are converted.

While such large values are unlikely in normal use, it's still a potential overflow risk that could impact high-value protocols.

Vulnerability Details

Current _mint() and _burn() Implementation.

If amountToMint > uint128.max, it gets silently reduced, meaning:

• User receives a lower balance than expected.

• Supply tracking becomes inaccurate.

If a large institution deposits a massive amount (e.g., 2^130 units), the amount overflows, leading to incorrectly minted RTokens.

If a massive repayment occurs using DebtToken#burn(), the burned amount may be lower than expected, leaving debt under-accounted.

Actually, the mint() and burn() are defined as follows:

Impact

User lose funds in deposit and get profit in withdraw.

Tools Used

manual

Recommendations

Don't use conversion.