Core Contracts

Relevant Context

The DebtToken contract is responsible for managing user debt positions in a lending protocol. It uses a ray-based index system to track accumulated interest over time, where the index increases as interest accrues. The contract mints debt tokens to represent user borrowing positions.

Finding Description

The mint() function in the DebtToken contract contains two calculation issues that affect user debt positions:

1. The balanceIncrease calculation incorrectly uses scaledBalance which represents the actual debt amount rather than debt shares. This leads to an inflated interest calculation:

2. The amountToMint calculation incorrectly includes the balanceIncrease:

Impact Explanation

High. These calculation errors result in users being charged more debt than they actually owe, as the system both overcalculates the interest (balanceIncrease) and then double-counts it in the mint amount.

Likelihood Explanation

High. This issue will affect every user who borrows additional funds while having an existing debt position with accrued interest (i.e., when their stored index is lower than the current index).

Proof of Concept

Consider the following scenario:

1. Current index = 1.25 RAY

2. User has 100 debt shares (125 actual debt) with stored index = 1.0 RAY

3. User borrows additional 50 tokens

Current implementation:

• scaledBalance = 125 (actual debt)

• balanceIncrease = 125 * 1.25 - 125 * 1.0 = 31.25 (incorrect)

• amountToMint = 50 + 31.25 = 81.25

• New debt shares = 100 + 81.25/1.25 = 165

• Final debt amount = 165 * 1.25 = 206.25 (incorrect)

Correct calculation should be:

• User debt shares = 100

• balanceIncrease = 100 * (1.25 - 1.0) = 25

• amountToMint = 50 (without including balanceIncrease)

• New debt shares = 100 + 50/1.25 = 140

• Final debt amount = 140 * 1.25 = 175 (= original 125 + new debt 50)

Recommendation

1. Fix the balanceIncrease calculation to use debt shares instead of actual debt:

2. Remove balanceIncrease from the mint amount:

These changes ensure that interest accrual is calculated correctly based on debt shares and that new borrowing is handled separately from interest accumulation.