The totalSupply()
function incorrectly uses division (rayDiv
) instead of multiplication (rayMul
) to convert the stored scaled supply into the actual debt. This inverts the relationship between scaled balances and the interest index, leading to a critically understated total debt.
totalSupply()
should equal the sum of all users' scaled balances multiplied by the current interest index. Using rayDiv
violates this, leading to an understated total debt.
Debt balances are stored scaled by the interest index at the time of minting/burning.
For example:
If you borrow 100 units when the index is 1.1e27
(RAY), your scaled balance is stored as 100 / 1.1 = ~90.91
.
To get the actual debt, the scaled balance is multiplied by the current interest index
If the index rises to 1.2e27
, your actual debt becomes 90.91 * 1.2 = ~109.09
.
The contract’s totalSupply()
function does:
With our example:
Scaled supply = 90.91
Using rayDiv
: 90.91 / 1.2 = ~75.76
(total debt is understated by ~33%).
As the interest index increases (due to accrued interest), totalSupply()
decreases instead of increasing. This misrepresents the protocol’s total debt.\
The protocol relies on totalSupply()
to track total outstanding debt. If it’s understated, the system may allow excessive borrowing, risking insolvency.
Lenders earn interest based on the total debt. If totalSupply()
is incorrect, interest distributions will be miscalculated, shortchanging lenders.
Foundry
Replace rayDiv
with rayMul
in totalSupply()
:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.