Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double scaling logic implementation in `rToken` contract leads to locked funds

alexczm

Summary

Vulnerability Details

On deposit-ing to LendingPool, the amount of reserveAssets is transfered to pool and rToken::mint is called (via reserveLibrary).
The same amount is passed to internal OZ ERC20 _mint() function which calls _update().

_update is overridden by rToken to add scaling logic.

// RToken.sol
function _update(address from, address to, uint256 amount) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
@> uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

transfer is overridden too and implements same logic and then the parent's transfer is invoked with scaledAmount as argument.

// RToken.sol
function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
@> uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}

If we follow the parent's transfer call chain, the transfer calls OZ's ERC20::_transfer -> _update
-> rToken::_update -> OZ ERC20::_update

We can observe that on rToken transfer, the same scaling is applied twice, resulting in a lower actual amount transferred.

The rToken::transferFrom is called in StabilityPool::withdraw, transferring less value than intended. The delta amount is locked in contract.

Impact

Locked rToken assets in StabilityPool;

Tools Used

Recommendations

The ERC20::_update is called from all contexts that changes balances. Remove scaling from rToken::transfer and transferFrom

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.