Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

RToken::calculateDustAmount() not calculated correctly

oxaudron

Summary

The transferAccruedDust() calculates accrued dust amount based on `calculateDustAmount() which doesn't perform calculations correctly. The scaling is done twice for the balance.

Vulnerability Details

You can see that contract currentTotalSupply is the totalSupply() which returns already scaled value. And in the totalRealBalance it again scales it, which leads to miscalculation of the amount

function calculateDustAmount() public view returns (uint256) {
// Calculate the actual balance of the underlying asset held by this contract
uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this)).rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
​
// Calculate the total real obligations to the token holders
uint256 currentTotalSupply = totalSupply(); //@audit already scaled
​
// Calculate the total real balance equivalent to the total supply
uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
// All balance, that is not tied to rToken are dust (can be donated or is the rest of exponential vs linear)
return contractBalance <= totalRealBalance ? 0 : contractBalance - totalRealBalance;
}

Impact

Dust amount not calculated correctly due to double scaling the supply.

Tools Used

Manual Review

Recommendations

  • Use scaledTotalSupply() instead of totalSupply() which returns the non scaled total supply . So make the following changes :

- uint256 currentTotalSupply = totalSupply();
+ uint256 currentTotalSupply = scaledTotalSupply();
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::calculateDustAmount incorrectly applies liquidity index, severely under-reporting dust amounts and permanently trapping crvUSD in contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!