Core Contracts

Summary

In the mint function in the DebtToken contract, there was a logic error that caused the scaled amount to be incorrectly used when calculating the number of tokens that should be minted. This resulted in an inaccurate number of tokens minted.

Vulnerability Details

In the mint function, amount is used to calculate the final number of tokens to be minted without being properly scaled by index. The function calculates a scaled amount amountScaled = amount.rayDiv(index) but does not use that scaled amount in the final calculation of the number of coins to be minted. Instead, the function uses the original amount for the calculation, ignoring the effect of the scaling factor.

The amount represents the number of underlying tokens, and amountScaled is calculated based on the index. For example:

Assuming the amount is 100e18 and the index is 1.2e27, the amountScaled is 83,33333333333334e+18.

Impact

The original amount is used directly without being scaled by the index, resulting in an inaccurate amount. The relationship between amount and index is ignored, meaning you may mint too many or too few tokens.

Tools Used

Manual review

Recommendations

The final amountToMint should be calculated using amountScaled instead of the original amount. Therefore, the correct calculation should be: