Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect transfer amount in RToken::transfer()

x1485967

Summary

Incorrect transfer amount in RToken::transfer()

Vulnerability Details

In RToken::transfer(), users can transfer their rTokens. The input parameter is in underlying asset units. So we need to convert the amount to scaled amount. The problem is that we divide the getNormalizedIncome() twice, this will cause that the actual transfer amount is less than users' expectation.

In transfer() function, we will calculate the scaled amount for the input amount and then we trigger super.transfer(). In super.transfer() function, we will trigger _update() function in RToken, we will divide the getNormalizedIncome() again, and this will cause the actual transferred amount is less than users' expectation.

/**
* @dev Overrides the ERC20 transfer function to use scaled amounts
* @param recipient The recipient address
* @param amount The amount to transfer (in underlying asset units)
*/
function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}
function _transfer(address from, address to, uint256 value) internal {
...
_update(from, to, value);
}
function _update(address from, address to, uint256 amount) internal override {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

Impact

The actual transfer amount will less than users' expectation.

Tools Used

Manual

Recommendations

Do not need to calculate the scaled amount in transfer() function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.