Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Multiple scaling of amounts during transfers of rToken

damilolaedwards

Target

contracts/core/tokens/RToken.sol

Vulnerability Details

During the transfer of rToken using both transfer and transferFrom functions, the amount is scaled by the liquidity index calling the transfer/transferFrom of the parent contract using the scaled amount.

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}

RToken.transfer

function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}

RToken.transferFrom

However, before the actual transfer, the _update function is called, in this case the _update function is overridden and the passed-in amount is scaled again before the super._update is finally called, Hence across the entire execution flow, scaling is performed twice.

function _update(address from, address to, uint256 amount) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

RToken._update

Impact

This does not conform to aave’s implementation of the Atoken as tokens are only scaled once during transfers, this specification violation can introduce errors during transfers especially for users or third party integrations that assume the token complies with aave's token design.

Tools Used

Manual review

Recommendations

Remove the scaling logic within the transfer/transferFrom methods as it is already contained within the _update function which will automatically be executed during transfers

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!