Submission Details
Severity:
The dust amount is incorrectly calculated
Summary
The dust amount is wrongly calculated.
Vulnerability Details
The calculateDustAmount returns the dust amount in the contract
/**
* @notice Calculate the dust amount in the contract
* @return The amount of dust in the contract
*/
function calculateDustAmount() public view returns (uint256) {
// Calculate the actual balance of the underlying asset held by this contract
@> uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this)).rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
// Calculate the total real obligations to the token holders
uint256 currentTotalSupply = totalSupply();
// Calculate the total real balance equivalent to the total supply
uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
// All balance, that is not tied to rToken are dust (can be donated or is the rest of exponential vs linear)
return contractBalance <= totalRealBalance ? 0 : contractBalance - totalRealBalance;
}
Here totalSupply() is already converted to current index so no need to again multiply it with getNormalizedIncome to calculate totalRealBalance. (Double conversion happend)
Impact
Incorrect dust calculation lead to incorrect transfer of the accured dust amount.
Tools Used
Recommendations
Calculate dust as shown below.
function calculateDustAmount() public view returns (uint256) {
// Get the actual balance of the underlying asset held by this contract (in raw units)
uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this));
// Get the total supply in underlying asset units , here totalSupply() is already converted to the current index
uint256 currentTotalSupply = totalSupply();
// Compare raw balances to determine dust
return contractBalance <= currentTotalSupply ? 0 : contractBalance - currentTotalSupply;
}
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
RToken::calculateDustAmount incorrectly applies liquidity index, severely under-reporting dust amounts and permanently trapping crvUSD in contract
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.