Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`totalSupply` in DebToken contract is wrongly implemented, leading to `reserve.totalUsage` being set to wrong total usage, breaking core internal logic.

tadev

Summary

mint and burn functions in DebtToken contract both use totalSupply()as one of their returned value. The problem is that totalSupply returns an incorrect result.

function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledSupply = super.totalSupply();
return scaledSupply.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
}

Indeed, super.totalSupply()returns the total supply of debt tokens. Then, a division by the usage index is executed to retrieve the total amount of debt in terms of underlying asset units, but this is incorrect and it should instead be a multiplication.

When users interact with LendingPool contract through borrow, repay and, repayOnBehalf, or with the stability pool through liquidateBorrower, mintor burnDebtToken functions will be called, returning totalSupply()which is then used to set reserve.totalUsage. This is a serious vulnerability as it will lead to incorrect computation of utilization rate and interest rates.

Impact

The impact of this issue is high as it leads to systematic error when setting reserve.totalUsage when borrowing, repaying or liquidating. This will break internal computation of rates.

Tools Used

Manual review.

Recommendations

Make sure to correctly implement totalSupply in DebtToken contract so that it returns the total supply in underlying asset units:

function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledSupply = super.totalSupply();
return scaledSupply.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::totalSupply incorrectly uses rayDiv instead of rayMul, severely under-reporting total debt and causing lending protocol accounting errors

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::totalSupply incorrectly uses rayDiv instead of rayMul, severely under-reporting total debt and causing lending protocol accounting errors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.