Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

user's collateral value is missing from the reserve.reserveAssetAddress token value calculation, which fails to ensure that getUserCollateralValue returns the full collateral asset value

wttt

Summary

The user's collateral value is missing from the reserve.reserveAssetAddress token value calculation, which fails to ensure that getUserCollateralValue returns the full collateral asset value.

Vulnerability Details

function deposit(ReserveData storage reserve,ReserveRateData storage rateData,uint256 amount,address depositor) internal returns (uint256 amountMinted) {
if (amount < 1) revert InvalidAmount();
​
// Update reserve interests
updateReserveInterests(reserve, rateData);
​
// Transfer asset from caller to the RToken contract
IERC20(reserve.reserveAssetAddress).safeTransferFrom(
msg.sender, // from
reserve.reserveRTokenAddress, // to
amount // amount
);

This protocol supports depositing reserve.reserveAssetAddress as collateral.

/**
* @notice Gets the total collateral value of a user
* @param userAddress The address of the user
* @return The total collateral value
*/
function getUserCollateralValue(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
uint256 totalValue = 0;
​
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
uint256 price = getNFTPrice(tokenId);
totalValue += price;
}
​
return totalValue;
}

This getUserCollateralValue function only calculates the collateral value of the NFT, but if the user also deposits an ERC-20 token as collateral (reserve.reserveAssetAddress), then the calculation of this function is incomplete.

Impact

The most direct impact is that the user's health factor is calculated incorrectly. Even if the user deposits a large amount of IERC20 (reserve.reserveAssetAddress) as collateral, getUserCollateralValue does not calculate them here, and calculateHealthFactor calculates incorrectly.

Tools Used

Manual review

Recommendations

Extend the getUserCollateralValue function to include all collateral types deposited by the user function

function getUserCollateralValue(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
uint256 totalValue = 0;
​
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
uint256 price = getNFTPrice(tokenId);
totalValue += price;
}
//The calculation includes collateral in ERC-20 tokens
uint256 erc20Value = user.erc20Collateral * getTokenPrice(reserve.reserveAssetAddress);
totalValue += erc20Value;
return totalValue;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.