Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`rTokens` get double scaled when being transferred

kirobrejka

Summary

rTokens get double scaled when being transferred, which may lead to bad and inaccurate transfers

Vulnerability Details

As seen in the RToken::transfer function the amount is denominated in underling units, then it is scaled to match the corresponding amount of RToken and
then the ERC20:transfer function is called:

function transfer(
address recipient,
uint256 amount
) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(
@> ILendingPool(_reservePool).getNormalizedIncome()
);
return super.transfer(recipient, scaledAmount);
}

The problem here is that the ERC20::transfer function calls the ERC20::_update and in this moment in the codebase, the _update function is overriden to scale the amount again as seen here:

function _update(
address from,
address to,
uint256 amount
) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
@> uint256 scaledAmount = amount.rayDiv(
ILendingPool(_reservePool).getNormalizedIncome()
);
super._update(from, to, scaledAmount);
}

This means that the transferred amount gets double scaled, which will lead to many inaccurate transfers over time

Impact

Because of this improper amounts of tokens will be transferred when LendingPool::getNormalizedIncome is different than 1 Ray, which will happen 100% of the time after the first deposit. This can mainly be exploited in the StabilityPool, since in the StabilityPool::withdraw function, rTokens are directly transferred to the user

Tools Used

Manual Review

Recommendations

Don't scale the amount in the RToken::transfer function. Instead just leave this for the _update function

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!