Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RToken.sol transfer() and tranferFrom() will always transfer less amount than intended

wickie

Summary

The RToken's transfer() and transferFrom() intends to take in amount of underlying asset and transfer the corresponding amount of RTokens. They use rayDiv to get the RToken amount corresponding to the underlying asset amount and calls super.transfer() / super.transferFrom(). However the _update() is overridden to account for this, thus making it transfer the amount after calling rayDiv with the liqudityIndex twice.

Vulnerability Details

In transfer() and transferFrom(),

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}
​
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}

In _update(),

function _update(address from, address to, uint256 amount) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

Impact

This will causes the RToken transfers to be always less than intended. And will transfer 0 in low amounts.

Tools Used

Manual Review

Recommendations

Don't scale the amounts down in transfer() and transferFrom()

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.