Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect `totalRealBalance` calculation in calculateDustAmount

x1485967

Summary

Incorrect totalRealBalance calculation in calculateDustAmount

Vulnerability Details

In RToken::calculateDustAmount(), we will calculate the dust amount and then transfer this part as the revenue.

According to the comment, current design is that the owner can take current balance - balance tied with rToken as the dust amount. This means that we need to calculate current balance which is tied with all rTokens.

Currently, we use totalSupply() * liquidityIndex as the current balance which is tied with all rTokens. This is incorrect. Because the totalSupply() in RToken is super.totalSupply().rayMul(ILendingPool(_reservePool).getNormalizedIncome()). It means that totalSupply() is the total balance which is tied with rTokens, we don't need to multiple another getNormalizedIncome().

This will cause that we get one higher current balance which is tied with rTokens. And the owner may fail to get the expected dust.

function calculateDustAmount() public view returns (uint256) {
// Calculate the actual balance of the underlying asset held by this contract
uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this)).rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
// Calculate the total real obligations to the token holders
uint256 currentTotalSupply = totalSupply();
​
uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
return contractBalance <= totalRealBalance ? 0 : contractBalance - totalRealBalance;
}
function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
return super.totalSupply().rayMul(ILendingPool(_reservePool).getNormalizedIncome());
}

Impact

This will cause that we get one higher current balance which is tied with rTokens. And the owner may fail to get the expected dust.

Tools Used

Manual

Recommendations

Take currentTotalSupply as totalRealBalance.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::calculateDustAmount incorrectly applies liquidity index, severely under-reporting dust amounts and permanently trapping crvUSD in contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.