Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Inconsistent balance and total supply calculation in debt token

danzero

Summary

The contract applies inconsistent calculations when adjusting balances, which can lead to incorrect token totals. This mismatch may cause the total supply to be out of sync with individual balances.

Vulnerability Details

Below is a snippet of the balanceOf and totalSupply functions from DebtToken.sol:

/**
* @notice Returns the scaled debt balance of the user
* @param account The address of the user
* @return The user's debt balance (scaled by the usage index)
*/
function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}
​
/**
* @notice Returns the scaled total supply
* @return The total supply (scaled by the usage index)
*/
function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledSupply = super.totalSupply();
return scaledSupply.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
}

  • balanceOf() scales up by multiplying with getNormalizedDebt().

  • totalSupply() scales down by dividing by getNormalizedDebt().

This mismatch leads to inconsistencies, causing the total supply to be misaligned with the sum of individual balances.

Impact

The inconsistent scaling of balances can create discrepancies between the total supply of debt tokens and individual user balances. In the lending pool, incorrect debt token balances could result in incorrect amount of minting and burning of debt token, affecting borrowing and repayment mechanics. These issues could eventually, disrupt the protocol’s ability to maintain a healthy debt market, bad debt accumulation, and improper liquidation.

Tools Used

Manual Review

Recommendations

Ensure Consistent Scaling: Both balanceOf() and totalSupply() should either multiply or divide by getNormalizedDebt().

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::totalSupply incorrectly uses rayDiv instead of rayMul, severely under-reporting total debt and causing lending protocol accounting errors

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::totalSupply incorrectly uses rayDiv instead of rayMul, severely under-reporting total debt and causing lending protocol accounting errors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!