Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Wrong computation of `balanceIncrease` in `burn` function in DebtToken contract.

tadev

Summary

burn function in DebtToken contract is defined as follows:

function burn(address from, uint256 amount, uint256 index)
external
override
onlyReservePool
returns (uint256, uint256, uint256, uint256)
{
if (from == address(0)) revert InvalidAddress();
if (amount == 0) {
return (0, totalSupply(), 0, 0);
}
​
uint256 userBalance = balanceOf(from);
​
// @audit LOW: double multiplication scaling for userBalance leads to wrong balanceIncrease
uint256 balanceIncrease = 0;
if (_userState[from].index != 0 && _userState[from].index < index) {
uint256 borrowIndex = ILendingPool(_reservePool).getNormalizedDebt();
balanceIncrease = userBalance.rayMul(borrowIndex) - userBalance.rayMul(_userState[from].index);
amount = amount;
}
​
_userState[from].index = index.toUint128();
​
if (amount > userBalance) {
amount = userBalance;
}
​
uint256 amountScaled = amount.rayDiv(index);
​
if (amountScaled == 0) revert InvalidAmount();
​
_burn(from, amount.toUint128());
emit Burn(from, amountScaled, index);
​
return (amount, totalSupply(), amountScaled, balanceIncrease);
}

The issue arises because balanceIncrease is incorrectly computed. Indeed, userBalance corresponds to the balance in underlying asset units (after one index multiplication). But userBalance is then multiplied again by the index, which is incorrect and corresponds to a double multiplication scaling by the index.

Vulnerability Details

balanceIncrease is wrongly computed, with an over-estimated result. Consequences are not important because balanceIncrease return value is never used. Originally, aToken AAVE implementation uses balanceIncrease for event emission to track balance variations.

Impact

The impact of this issue is low.

Tools Used

Manual review.

Recommendations

Make sure to properly compute balanceIncrease and properly use it.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken::burn calculates balanceIncrease (interest) but never applies it, allowing borrowers to repay loans without paying accrued interest

Interest IS applied through the balanceOf() mechanism. The separate balanceIncrease calculation is redundant/wrong. Users pay full debt including interest via userBalance capping.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken::burn calculates balanceIncrease (interest) but never applies it, allowing borrowers to repay loans without paying accrued interest

Interest IS applied through the balanceOf() mechanism. The separate balanceIncrease calculation is redundant/wrong. Users pay full debt including interest via userBalance capping.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!