Core Contracts

Summary

In the DebtToken.sol contract, the burn function contains a bug where the accrued interest (represented by balanceIncrease) is calculated but never added to the burn amount. This omission allows borrowers to effectively repay their loans without covering the full interest accrued, undermining the protocol’s debt accounting and revenue model.

Vulnerability Details

Within the burn function, the following code snippet is intended to adjust the repayment amount by incorporating accrued interest:

• The variable balanceIncrease calculates the additional debt due to interest accrual.

• However, instead of adding balanceIncrease to amount, the code leaves amount unchanged.

• As a result, when _burn is executed, it burns only the original amount rather than the intended amount + balanceIncrease.

Impact

• Under-Repayment of Debt:
  Borrowers may repay only the principal portion of their debt, effectively avoiding the full payment of accrued interest. This creates an incentive for users to exploit the discrepancy and reduce their overall repayment obligations.

• Revenue Loss for the Protocol:
  Interest represents a critical component of the protocol’s revenue. By not accounting for the accrued interest during burn operations, the protocol loses expected revenue, potentially affecting its sustainability.

• Inaccurate Debt Accounting:
  The inconsistency between interest accrual and burn calculations may lead to discrepancies in user balances and the total debt supply. This undermines the financial integrity and trustworthiness of the protocol.

Tools Used

Manual Code Review

Recommendations

Correct the Burn Calculation:

Update the burn logic to include the accrued interest in the amount to be burned. For example: