Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The transferFrom quoted a stale nomalizedAmount and double scales amount to transfer

ChainProof

Summary

The transferFrom function uses getNormalizedIncome without updating the state, and also double scales the amount to transfer.

Vulnerability Details

The transferFrom of the Rtoken allow users to transfer their tokens to another address

/**
* @dev Overrides the ERC20 transferFrom function to use scaled amounts
* @param sender The sender address
* @param recipient The recipient address
* @param amount The amount to transfer (in underlying asset units)
*/
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}

The issue with this implementation is that, it uses the getNormalizedIncome which returns the previous normalizedIncome and does not update the state, this will lead to transferring incorrect amount.

Another issue with this is that, the function scales the amount in the transfer function, then again the overridden internal _update did the same , this will lead to incorrect scaling and thus incorrect transfer of assets

Impact

Incorrect scaling of the assets an also incorrect interest quote.

Tools Used

Manual review

Recommendations

Scales the amount only once and update the interest by calling the updateState before quoting the normalizedIncome.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

RToken::transfer uses getNormalizedIncome() while transferFrom uses _liquidityIndex, creating inconsistent transfer amounts depending on function used

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

RToken::transfer uses getNormalizedIncome() while transferFrom uses _liquidityIndex, creating inconsistent transfer amounts depending on function used

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.