Submission Details
Severity:
Incorrect event emitted during DebtToken and RToken burning
Summary
The burned amount should reflect the unscaled amount being removed from the balance minus any accrued interests. If the accrued interests exceed the unscaled amount, then the correct event to be emitted would be a mint.
Vulnerability Details
Impact
Tools Used
Manual review
Recommendations
Use AAVE's implementation as a reference:
if (balanceIncrease > amount) {
uint256 amountToMint = balanceIncrease - amount;
emit Transfer(address(0), user, amountToMint);
emit Mint(user, user, amountToMint, balanceIncrease, index);
} else {
uint256 amountToBurn = amount - balanceIncrease;
emit Transfer(user, address(0), amountToBurn);
emit Burn(user, target, amountToBurn, balanceIncrease, index);
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RToken::burn emits wrong event info
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RToken::burn emits wrong event info
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.