Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double scaling of amount in RToken#transfer() causes incorrect transfers

newspacexyz

Summary

The RToken#transfer() scales amount before calling _update(), but _update() also scales amount.

  • This results in amount being incorrectly reduced, causing incorrect transfers.

  • The recipient receives less than expected, and the sender loses more than they should.

Vulnerability Details

Current RToken#transfer() Implementation

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
@> uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}

Current _update() Implementation

function _update(address from, address to, uint256 amount) internal override {
@> uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

Instead of sending amount, the recipient receives amount / (index * index).

Impact

The sender loses more tokens than intended - Funds loss.

The recipient receives less than expected.

Tools Used

manual

Recommendations

Remove transfer() to prevent scaling.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.