Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Debt Balance Update in _repay() function

nourelden

Vulnerability Details

The debt repayment process contains a critical accounting error where the protocol incorrectly updates users' scaled debt balances using raw asset amounts instead of interest-scaled values. This occurs due to:

Wrong Value Type Application

Uses raw asset amount (amountBurned) for scaled balance updates:

user.scaledDebtBalance -= amountBurned; // Should use amountScaled
​

Impact

Immediate Consequences

  • Permanent Accounting Corruption

    • Users appear to have negative debt positions

    • Total protocol debt becomes unreliable

  • Fund Locking

    Users cannot fully repay loans due to arithmetic errors

  • Liquidation System Failure

    Liquidators can't properly close positions with corrupted debt data

Recommendations

Fix Balance Update Logic

// Before (dangerous)
user.scaledDebtBalance -= amountBurned;
​
// After (correct)
user.scaledDebtBalance -= scaledAmount; // Use properly scaled value
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::borrow tracks debt as user.scaledDebtBalance += scaledAmount while DebtToken mints amount+interest, leading to accounting mismatch and preventing full debt repayment

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!