Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Valid

`scaledBalance` in `mint` function in RToken contract is calculated using `balanceOf` function which is incorrect.

Summary

When looking at AAVE ScaledBalanceTokenBase contract, we can see the following line:

uint256 scaledBalance = super.balanceOf(user);

scaledBalance is effectively the amount of interest-bearing token (RToken).

But in our case, scaleBalance is computed as follows:

uint256 scaledBalance = balanceOf(onBehalfOf);

This is problematic, because the balanceOf function in RToken is meant to return the balance of underlying token, i.e, balance after multiplying the RToken amount by the index :

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
}

Impact

The impact is medium as it leads to incorrect computation of scaledBalance. With the current design, there are no consequences because scaledBalance is only used to compute balanceIncrease which is never used.

In AAVE aToken implementation, balanceIncrease is used for event emission, but this part has been forgotten in RAAC protocol.

Tools Used

Manual review.

Recommendations

Make sure to correctly compute scaledBalance using super.balanceOf just like AAVE aTokens implementation.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint emits wrong info in the event

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint emits wrong info in the event

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.