Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Already scaled balances are being scaled which led to disrepancy and miscalculation in DebtToken

oxaudron

Summary

In the DebtToken there is a problem in the mint and burn function - double scaling of balanceIncrease causes high discrepancy and miscalculation of amount which should be minted or burned. This is probably caused, because developer doesn't take the consideration that they are finding the delta of scaled value and again rescaling the scaled up value :

Intended :

  • The balanceIncrease should be calculated based on scaled up delta

Implemented :

  • The balanceIncrease is calculated based on double scaled up delta

Vulnerability Details

So what the function basically does is that it stores the scaled balance in the - scaledBalance for mint and userBalance for burn. And it is supposed to find the delta between the indexes and update the index to calculate the balanceIncrease. However the operation is done on already scaled balance which is really bad.

balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index); //DebtToken::mint
balanceIncrease = userBalance.rayMul(borrowIndex) - userBalance.rayMul(_userState[from].index); // DebtToken::burn

And here is the snippet of balanceOf() function code which already scales the amount with the usage index :

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt()); //getNormalizedDebt => usage index
}

Impact

  • Discrepancy and miscalculation of funds while minting and burning

Tools Used

Recommendations

Change the scaledBalance for mint() value to scaleBalanceOf(onBehlfOf) and userBalance for burn() value to scaleBalanceOf(from)

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!