Core Contracts

Summary

In the mint function of the RToken contract, accrued interest—represented by the balanceIncrease variable—is calculated but not added to the amount to be minted. As a result, the minted token amount does not fully account for the accrued interest, potentially leading to inaccurate token balances and misrepresentation of users’ underlying deposits.

Vulnerability Details

During the minting process, the function computes balanceIncrease as the difference between the user’s current scaled balance (adjusted for the updated liquidity index) and the previous balance. This value represents the additional accrued interest on the user’s deposit. However, the current implementation directly mints tokens based solely on the provided amountToMint:

Impact

• Inaccurate Token Balances: Users might receive token amounts that do not fully represent their underlying deposit value, leading to discrepancies in balance calculations.

• Economic Discrepancies: The protocol’s economic model and yield distribution mechanisms may be adversely affected, potentially resulting in user dissatisfaction and trust issues.

• System Integrity Risks: Over time, these inaccuracies could compound, leading to broader issues in accounting, token supply, and distribution of interest accruals.

Tools Used

Manual audit

Recommendations

• Adjust Minting Logic: Modify the mint function to add the computed balanceIncrease to amountToMint before calling _mint. For example: