Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Wrong check being used in `RToken::burn `

fromeo_016

Summary

In RToken::burn , there is an if statement to check if the amount of RTokens a user wants to burn is more than his balance, but the amount used is wrong, because this amount according to the natspec, the amount is in units of the underlying asset, e.g crvUSD. While the balance is in units of RTokens

// @param amount The amount to burn (in underlying asset units)
uint256 userBalance = balanceOf(from);
​
_userState[from].index = index.toUint128();
​
if(amount > userBalance){
amount = userBalance;
}

As seen above, the userBalance is in units of RTokens, while the amount that it's compared against is from the parameter passed to the function which is in units of underlying assets

Impact

  • This incorrect balance checks leads to the wrong amount being burned

Tools Used

Manual Review

Recommendations

The code should convert the input amount to RToken units before the balance comparison

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Wrong balance check in RToken::burn

It's underlying vs underlying

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.