Core Contracts

Summary

The calculateDustAmount() is used to let the owner allocate accrued dust into some address in transferAccruedDust(). However the function wrongly calculates the dust amount, which causes the function to always return 0, effectively locking all dust amounts in the contract.

Vulnerability Details

In the function, it first calculate the RToken amount correpsonding to the underlying asset in the contract.

Then it calls totalSupply(), which will return the deposits + interest owed to liquidity providers.

This is scaled again by the liquidityIndex which inflates the actual amount the protocol owes to the liquidity providers.

The totalRealBalance will always be greater than the contractBalance, thus the function always returns 0.

Impact

Dust can never be collected

Tools Used

Manual Review

Recommendations

A potential solution is to use scaledBalanceOf which will return the total loaned out amount by the protocol, or rayDiv() the totalSupply of RToken with current liquidityIndex. However this wont still return the accurate dust amount since the underlying asset is meant to be loaned out. So comparing the current asset held by the contract in term of RToken and all asset loaned out by the protocol in term of RToken will make the function return 0 in most cases but not always. I think the developers should re-design the whole function.