Core Contracts

Summary

The calculateRcrvUSDAmount function applies incorrect scaling formulae when converting deToken back to rToken.When rTokenDecimals < deTokenDecimals, users may receive significantly more rTokens than expected while burning only a small amount of deToken and in most cases DOS users due to InsufficientBalance check.When rTokenDecimals > deTokenDecimals, users will burn their deTokens but receive no rTokens due to rounding resulting in a loss of funds.

Vulnerability Details

calculateRcrvUSDAmount uses this code to convert deToken to equivalent rToken

If rTokenDecimals < deTokenDecimals, the scaling factor is too small making the returned rToken amount too large therefore users will attempt withdrawing disproportionate value of rToken

If rTokenDecimals > deTokenDecimals, the scaling factor is too large making the returned rToken amount too small, causing users to receive fewer tokens than they should or even 0 tokens.

Scenario 1: Overwithdrawal (rTokenDecimals = 6, deTokenDecimals = 18)

User has 100 deToken.
getExchangeRate() returns 1e18 (1:1 ratio).
Expected withdrawal: 100 rToken (which has 6 decimals).

Current Calculation:

User receives 1e32 rToken instead of 1e8 .This most likely DOS the user due to sufficient balance checks in the withdrawal or still user withdraws a disproportional amount which later leads to Dos for future withdrawals.

Scenario 2: Underwithdrawal (rTokenDecimals = 18, deTokenDecimals = 6)

Setup:
User has 100 rToken (which has 18 decimals).
getExchangeRate() returns 1e18 (1:1 ratio).
Expected withdrawal: 100 rToken.

user burns their deTokens but receives no rTokens in return. This scenario causes complete loss of funds for the user

Impact

• users receive disproportionately large rToken withdrawals potentially causing a Denial of Service (DOS).

• Users can receive no rTokens while burning deTokens incase of scenario 2.

Tools Used

Manual review

Recommendations

Update the calculateRcrvUSDAmount function to use the correct scaling factor: