Core Contracts

Summary :

The total supply should reflect the total debt including accrued interest, which means it should use rayMul with the current index, not rayDiv.

Vulnerability Details :

Using rayDiv reduces the total supply value instead of increasing it with accumulated interest, which is incorrect for a debt token.

In DebtToken.sol, totalSupply is calculated using rayDiv:

While individual user debt is correctly calculated using rayMul:

This creates inconsistency between:

• Individual debt calculations (correct)

• Total protocol debt (incorrect)

Example scenario:

1. Total debt = 1000 tokens

2. Interest index = 1.1

3. Current implementation: 1000.rayDiv(1.1) ≈ 909 tokens

4. Correct calculation: 1000.rayMul(1.1) = 1100 tokens

5. Results in 191 tokens of unaccounted debt

Impact :

The current rayDiv implementation would lead to incorrect total debt calculations and potential protocol accounting issues.

Tools Used :

Manuel review.

Recommendations :

Update totalSupply to use rayMul.