Submission Details
Severity:
`RToken.sol#transfer` and `RToken.sol#transferFrom` not comply with the ERC-20
Vulnerability Details
RToken.sol#transfer and RToken.sol#transferFrom do not comply with the ERC-20 specification. The input amount should be amount of RTokens, not amount of underlying tokens.
/// @dev https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/RToken.sol#L207-L215
/**
* @dev Overrides the ERC20 transfer function to use scaled amounts
* @param recipient The recipient address
* @param amount The amount to transfer (in underlying asset units)
*/
function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}
Impact
It will affect other contracts' token interactions.
Tools Used
Manual.
Recommendations
It should design another interface to implementation.
i.e.
interface ISomeFeature {
function transferAsset(address to, uint256 underlyingAmount) external returns (true);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.