Core Contracts

Finding Description and Impact

In the mint function, when amountToMint == 0, the function returns (false, 0, 0, 0). However, the third value in the tuple (total supply) should return totalSupply() instead of 0.

Impact:

• Off-chain systems or integrations relying on the return value of mint may misinterpret the total supply.

• This could lead to incorrect accounting or reporting of the protocol's state.

Proof of Concept

1. Code Reference:

   function mint(

   address caller,

   address onBehalfOf,

   uint256 amountToMint,

   uint256 index

   ) external override onlyReservePool returns (bool, uint256, uint256, uint256) {

   if (amountToMint == 0) {

   return (false, 0, 0, 0); // @audit the second 0 says that the totalsupply is always 0, it should return totalSupply()

   }

   ...

   }

2. Steps to Reproduce:

   • Deploy the RToken contract.

   • Call mint with amountToMint == 0.

   • Observe that the third return value is 0 instead of totalSupply().

Recommended Mitigation Steps

Update the mint function to return totalSupply() as the third value in the tuple when amountToMint == 0:

This ensures that the total supply is accurately reported, even for zero-amount mints.