Submission Details
Severity:
`RToken.sol#mint`: Incorrectly implementation for rebase token
Vulnerability Details
The RToken.sol implements an interest-bearing token where users' balances increase over time as they accrue interest.
rebase mechanism:
function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
// balance stored in storage
uint256 scaledBalance = super.balanceOf(account);
// balance * index / ray
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
}
The amount of tokens to mint should be determined based on the following calculation formula, rather than directly using amountToMint to mint tokens. In this way, interest can be accumulated by updating the index.
formula:
/// @dev https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/RToken.sol#L114-L141
function mint(
address caller,
address onBehalfOf,
uint256 amountToMint,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256, uint256) {
// ...
// amount to mint
uint256 amountScaled = amountToMint.rayDiv(index);
// incorrect input
_mint(onBehalfOf, amountToMint.toUint128());
// ...
}
Impact
Due to incorrect input, the #mint function will mint an excessive amount of tokens.
Recommendations
contract RToken is ERC20, ERC20Permit, IRToken, Ownable {
// accrue
function _accrueIndex() internal {
_liquidityIndex = ILendingPool(_reservePool).getNormalizedIncome();
}
// mint
function mint(
address caller,
address onBehalfOf,
uint256 amountToMint, // The amount of tokens to mint (in underlying asset units)
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256, uint256) {
// ...
// accrue index
_accrueIndex();
uint256 amountScaled = amountToMint.rayDiv(index);
// ...
// mint share token
_mint(onBehalfOf, amountScaled);
// ...
}
}
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
RToken::mint should mint the amountScaled not the amountToMint
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
RToken::mint should mint the amountScaled not the amountToMint
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.