Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Return Value in `ReserveLibrary::withdraw` Function

federodes

Summary

The withdraw function contains an error in its return statement, where the amountUnderlying variable is returned in place of amountWithdrawn.

Vulnerability Details

The withdraw function is designed to return three values:

return (amountWithdrawn, burnedScaledAmount, amountUnderlying);

However, amountUnderlying is being returned in place of the first amountWithdrawn.

function withdraw(
ReserveData storage reserve,
ReserveRateData storage rateData,
uint256 amount,
address recipient
) internal returns (uint256 amountWithdrawn, uint256 amountScaled, uint256 amountUnderlying) {
if (amount < 1) revert InvalidAmount();
​
// Update the reserve interests
updateReserveInterests(reserve, rateData);
​
// Burn RToken from the recipient - will send underlying asset to the recipient
(uint256 burnedScaledAmount, uint256 newTotalSupply, uint256 amountUnderlying) = IRToken(reserve.reserveRTokenAddress).burn(
recipient, // from
recipient, // receiverOfUnderlying
amount, // amount
reserve.liquidityIndex // index
);
@> amountWithdrawn = burnedScaledAmount;
​
// Update the total liquidity and interest rates
updateInterestRatesAndLiquidity(reserve, rateData, 0, amountUnderlying);
​
emit Withdraw(recipient, amountUnderlying, burnedScaledAmount);
​
@> return (amountUnderlying, burnedScaledAmount, amountUnderlying);
}

This error leads to incorrect reporting of the withdrawn amount, which could cause accounting inconsistencies in other parts of the protocol or in external integrations.

Impact

  • Misreported withdrawal amounts could lead to incorrect balances in the protocol.

  • External contracts relying on these values may calculate rewards, interest, or fees incorrectly.

Tools Used

Manual review

Recommendations

  • Update the return statement to correctly return amountWithdrawn:

    return (amountWithdrawn, burnedScaledAmount, amountUnderlying);

This ensures accurate tracking of withdrawals and prevents downstream miscalculations.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

ReserveLibrary::withdraw returns amountUnderlying instead of amountWithdrawn, causing incorrect event emissions and potential calculation errors in LendingPool

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

ReserveLibrary::withdraw returns amountUnderlying instead of amountWithdrawn, causing incorrect event emissions and potential calculation errors in LendingPool

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.