Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect data minted in event

damilolaedwards

Target

contracts/core/pools/LendingPool/LendingPool.sol

Summary

The event emitted within the deposit function of the Lendingpool contract may contain incorrect data potentially misleading offchain systems that rely on the emitted event’s data.

Vulnerability Details

When the LendingPool.deposit function is called, the amount of underlying asset to be deposited in the pool is passed in as an argument to the function, next, the deposit function in the reserve library is executed, passing in the amount as part of the arguments, this then calls the mint function of the rToken contract to mint deposit shares to the user.

function mint(
address caller,
address onBehalfOf,
uint256 amountToMint,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256, uint256) {
if (amountToMint == 0) {
return (false, 0, 0, 0);
}
uint256 amountScaled = amountToMint.rayDiv(index);
if (amountScaled == 0) revert InvalidAmount();
​
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
_mint(onBehalfOf, amountToMint.toUint128());
​
emit Mint(caller, onBehalfOf, amountToMint, index);
​
return (isFirstMint, amountToMint, totalSupply(), amountScaled);
}

RToken.mint

Here’s where the issue originates from, tracing back from the rToken contract, after the execution of RToken.mint, it returns 4 values :
A tuple containing:
* - isFirstMint (bool): True if this is the first mint for the recipient, false otherwise
* - amountToMint (uint256): The amount of scaled tokens minted
* - total supply (uint256): The new total supply after minting
* - amountScaled (uint256): The amount of underlying tokens minted
However, the amountToMint value is incorrect, during the execution of the _mint function the amount passed in is scaled by the liquidity index and the resulting amount is minted to the user

function _update(address from, address to, uint256 amount) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

RToken._update

Therefore, when the execution is traced back to the initial entry point, LendingPool.deposit, it will be discovered that the value emitted as the minted rTokens amount is actually the amount of the underlying asset supplied thereby incorrect

Impact

These potentially incorrect event data may mislead systems that rely on the emitted values from the contract

Tools Used

Manual Review

Recommendations

Update the returned values from the Rtoken mint function to reflect the correct data

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint doesn't return data in the right order, making the protocol emit wrong events

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint doesn't return data in the right order, making the protocol emit wrong events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!