Submission Details
Severity:
Suppliers are minted a wrong amount which results in them immediately being in profit
Summary
Suppliers are minted a wrong amount which results in them immediately being in profit
Vulnerability Details
Upon users supplying, we reach RToken::mint() where we have the following line:
_mint(onBehalfOf, amountToMint.toUint128());
We mint the amountToMint value which is actually the amount of assets the user supplies. This is incorrect as we should be minting a scaled value.
This results in the suppliers immediately being in profit:
Index is 1.5 and user supplies 100 tokens
We mint him 100 tokens
As the index is 1.5, the user is owed 150 tokens
Impact
Suppliers are immediately in profit
Tools Used
Manual Review
Recommendations
Divide by index first
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RToken::mint should mint the amountScaled not the amountToMint
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RToken::mint should mint the amountScaled not the amountToMint
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.