Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double scaling of amount in RToken#transfer() causes incorrect transfers

newspacexyz

Summary

The RToken#transfer() scales amount before calling _update(), but _update() also scales amount.

  • This results in amount being incorrectly reduced, causing incorrect transfers.

  • The recipient receives less than expected, and the sender loses more than they should.

Vulnerability Details

Current RToken#transfer() Implementation

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
@> uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}

Current _update() Implementation

function _update(address from, address to, uint256 amount) internal override {
@> uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

Instead of sending amount, the recipient receives amount / (index * index).

Impact

The sender loses more tokens than intended - Funds loss.

The recipient receives less than expected.

Tools Used

manual

Recommendations

Remove transfer() to prevent scaling.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!