Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect balance increase calculation in RToken and DebtToken due to double index multiplication

shui

Summary

The balance increase calculation in both RToken and DebtToken is incorrect because it uses balanceOf() which already returns the balance multiplied by the current index, leading to inflated interest calculations.

Vulnerability Details

In both RToken and DebtToken, when calculating the balance increase (accrued interest) on the mint and burn function, the contracts use balanceOf() which already returns a scaled balance (raw balance * index from the lending pool)

DebtToken:

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}
​
// For example in mint():
uint256 scaledBalance = balanceOf(onBehalfOf); // Already multiplied by current usage index
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
// @audit Double multiplication: scaledBalance is already multiplied by current index
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}

RToken:

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
}
​
// Similar issue in mint():
uint256 scaledBalance = balanceOf(onBehalfOf); // Already multiplied by current liquidity index
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
// @audit Double multiplication: scaledBalance is already multiplied by current index
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}

The issue is that:

balanceOf() returns the balance already multiplied by the current index from the lending pool
The balance increase calculation then multiplies this already-scaled balance by the index again
This leads to substantially inflated interest calculations

Impact

High. This double multiplication of indices leads to:

  • Significantly inflated interest calculations

  • Incorrect debt accounting in DebtToken

  • Incorrect interest distribution in RToken

  • Affects all users with existing positions when new operations occur

Recommended Mitigation

Use super.balanceOf() to get the raw balance before scaling:

// For both RToken and DebtToken:
uint256 rawBalance = super.balanceOf(onBehalfOf);
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = rawBalance.rayMul(index) - rawBalance.rayMul(_userState[onBehalfOf].index);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.