Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Any user can avoid debt by transfer debt token to address(0)

zukanopro

Vulnerability Details

From documentation link, it is said that burning action only allowed by Reserve Pool only.

function _update(address from, address to, uint256 amount) internal virtual override {
if (from != address(0) && to != address(0)) {
revert TransfersNotAllowed(); // Only allow minting and burning // <--
}
​
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
super._update(from, to, scaledAmount);
emit Transfer(from, to, amount);
}

But function transfer() is still callable, and it will not revert if from or to address is address(0) . So the attacker can burning token by transfer token to address(0) . Which is big problem because user debt is calculated base on debt token balance of that user:

function _repay(uint256 amount, address onBehalfOf) internal {
. . . . . .
// Calculate the user's debt (for the onBehalfOf address)
uint256 userDebt = IDebtToken(reserve.reserveDebtTokenAddress).balanceOf(onBehalfOf);
uint256 userScaledDebt = userDebt.rayDiv(reserve.usageIndex);
. . . . . .
}

Impact

Attacker can remove debt by transfer token to address(0)

Recommendations

Do not allow transfer debt token

Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken permits burning via transfer to address(0), breaking protocol accounting and making debt repayment impossible, permanently locking collateral

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken permits burning via transfer to address(0), breaking protocol accounting and making debt repayment impossible, permanently locking collateral

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!