Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect event emission in LendingPool#_repay()

newspacexyz

Summary

The LendingPool#repay() **** emits an incorrect repayment amount in the Repay event. Specifically:

actualRepayAmount is not correctly calculated due to an incorrect usage of userScaledDebt, which does not reflect the exact debt owed after interest accrual.

Vulnerability Details

function _repay(uint256 amount, address onBehalfOf) internal {
...
// Calculate the user's debt (for the onBehalfOf address)
uint256 userDebt = IDebtToken(reserve.reserveDebtTokenAddress).balanceOf(onBehalfOf);
@> uint256 userScaledDebt = userDebt.rayDiv(reserve.usageIndex);
​
// If amount is greater than userDebt, cap it at userDebt
@> uint256 actualRepayAmount = amount > userScaledDebt ? userScaledDebt : amount;
...
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
...
​
emit Repay(msg.sender, onBehalfOf, actualRepayAmount);
}

userScaledDebt is miscalculated and this value is the correct value at reserve.usageIndex = 1e27 and does not account for interest accruals correctly.

But reserve.usageIndex is increased now, so actualRepayAmount can be smaller than current amount value. Thus actualRepayAmount is miscalculated and user transfers amoutScaled to this contract, so amoutScaled is correct value to emit on event.

Impact

This causes incorrect event logging, which can mislead users and analytics tools.

Tools Used

manual

Recommendations

The correct value to emit is amountScaled, which accurately represents the repayment amount.

- emit Repay(msg.sender, onBehalfOf, actualRepayAmount);
+ emit Repay(msg.sender, onBehalfOf, amountScaled);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_repay emits Repay event with capped actualRepayAmount instead of the real amountScaled value that was transferred, causing misleading event data

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_repay emits Repay event with capped actualRepayAmount instead of the real amountScaled value that was transferred, causing misleading event data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!