Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect event emission due to unscaled debt.

oxelmiguel

Summary

The repayment function incorrectly scales the user’s debt when determining the actualRepayAmount, but this does not impact core logic, only the emitted event. The issue arises from unscaling an already scaled debt amount before capping the repayment value.

Vulnerability Details

Issue

In the _repay function, the user's debt is retrieved and then unscaled using rayDiv(reserve.usageIndex), leading to an incorrect actualRepayAmount:

uint256 userDebt = IDebtToken(reserve.reserveDebtTokenAddress).balanceOf(onBehalfOf);
uint256 userScaledDebt = userDebt.rayDiv(reserve.usageIndex);
uint256 actualRepayAmount = amount > userScaledDebt ? userScaledDebt : amount;

  • Problem: balanceOf already returns the correctly scaled debt. The unscaling step is unnecessary.
    https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/DebtToken.sol#L223

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}

  • Effect: The actualRepayAmount value is lower than intended, but since it is only used in the event emission, there is no security risk but causes inconsistencies in event emission.

Example of Incorrect Behavior

Parameter Value
userDebt 80 RAY
usageIndex 1.2 RAY
amount 90

Incorrect Calculation:

userScaledDebt = 96 / 1.2 = 80 // balanceOf return 80 * 1.2
actualRepayAmount = min(90, 80) = 80 (incorrect reference)

  • The event emitted that user repay 80 debt instead of 90

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L430

Impact

  • Incorrect Event Logging: The Repay event may display a lower repayment value than what actually occurred.

  • Potential UI Confusion: If front-end applications rely on actualRepayAmount, they may show incorrect repayment details.

Tools Used

  • Manual Code Review

Recommendations

balanceOf return the correct scaled debt, protocol should use it.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_repay emits Repay event with capped actualRepayAmount instead of the real amountScaled value that was transferred, causing misleading event data

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_repay emits Repay event with capped actualRepayAmount instead of the real amountScaled value that was transferred, causing misleading event data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.