Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect Debt Burning Logic in _repay - LendingPool.sol

jefextar

Summary

The _repay function burns an incorrect amount of DebtTokens, allowing users to repay less than owed while burning all debt, leading to collateral theft.

Vulnerability Details

_repay passes the underlying asset amount directly to DebtToken.burn, but DebtTokens expect a scaled balance. This underestimates the debt to burn, enabling users to repay only a portion but have their entire debt forgiven.

Impact

Users can repay 0 debt while burning their entire DebtToken balance, allowing them to keep their collateral without repaying funds. Critical exploit risk.

Tools Used

  • Slither: Detects parameter mismatches between amount and scaled balance calculations.

  • Mythril: Flags unexpected state changes in DebtToken interactions.

Recommendations

Convert the amount to a scaled value using reserve.usageIndex before burning.

uint256 scaledAmount = amount.rayDiv(reserve.usageIndex);
debtToken.burn(userAddress, scaledAmount, reserve.usageIndex);
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.