Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Important RToken functions cannot be reached

OpaBatyo

Summary

Some important functions in the RToken contract cannot be reached.

Vulnerability Details

These 2 functions in the RToken contract are only callable by the ReservePool:

function updateLiquidityIndex(uint256 newLiquidityIndex) external override onlyReservePool ;
function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyReservePool ;

The ReservePool in this context is actually the LendingPool contract. I am not sure if the devs forgot to update the name but we can see multiple functions in the lending pool which invoke functions of the RToken contract with the onlyReservePool modifier:

function borrow(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
...
// Transfer borrowed amount to user
IRToken(reserve.reserveRTokenAddress).transferAsset(msg.sender, amount);
...
}

The issue is that the updateLiquidityIndex() and rescueTokens() functions in RToken cannot be called since there are no implemented functions in the LendingPool contract which invoke them. The latter is not that big of an issue, but the former is important since updating the liquidity index plays an important role during RToken transfers:

function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}

Impact

RToken transfers will operate based on an outdated _liquidityIndex value and transfer incorrect amounts since there is no way to update it.

Tools Used

Manual Review

Recommendations

Implement functions which allow the LendingPool to call those 2 RToken functionalities.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::rescueToken() can never be called

RToken::updateLiquidityIndex() has onlyReservePool modifier but LendingPool never calls it, causing transferFrom() to use stale liquidity index values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!