Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

DebtToken incorrectly includes accrued interest in mint amount leading to double interest accrual

shui

Summary

The DebtToken.sol contract incorrectly includes accrued interest in the amount being minted, which results in double interest accrual since this interest amount is being minted as new debt.

Vulnerability Details

In DebtToken.sol, when minting new tokens, the contract adds the accrued interest to the amount being minted:

uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
// @audit incorrect - includes balanceIncrease in mint amount
uint256 amountToMint = amount + balanceIncrease;
_mint(onBehalfOf, amountToMint.toUint128()); <@

The _mint function will then call the overridden _update function the RAAC team wrote that will scale down the amount.

function _update(address from, address to, uint256 amount) internal override {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
super._update(from, to, scaledAmount);
emit Transfer(from, to, amount);
}

Looking at Aave's implementation, the balanceIncrease (accrued interest) is only used for event emission purposes and not included in the actual minting:

_mint(onBehalfOf, amountScaled.toUint128());
​
uint256 amountToMint = amount + balanceIncrease;
// Only used for event emission, not actual minting
emit Transfer(address(0), onBehalfOf, amountToMint);

Impact

  • Users accrue double interest since the interest is being minted as new debt

  • Makes the debt accounting system incorrect

  • Affects all users who have existing debt positions when taking on new debt

Recommended Mitigation

Modify the minting logic to match Aave's implementation, where balanceIncrease is only used for event emission:

_mint(onBehalfOf, amount.toUint128());
​
uint256 amountToMint = amount + balanceIncrease;
emit Transfer(address(0), onBehalfOf, amountToMint);
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.