Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

RToken:: CalculateDust function has critical calculation error

DRUGstore

Summary

`transferAccruedDust` internally calls `calculateDust` function to transfer Dust amounts,however `calculateDust` has a math error that results in returning dust amount as always zero.

Vulnerability Details

totalSupply() function already returns totalSupply normalized by interest accrual.

function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
return super.totalSupply().rayMul(ILendingPool(_reservePool).getNormalizedIncome());


In totalRealBalance calculation, applying `rayMul` again with the normalized income index inflates the value.

function calculateDustAmount() public view returns (uint256) {
uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this)).rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
​
// Calculate the total real obligations to the token holders
uint256 currentTotalSupply = totalSupply();//; this gives in crvUSD terms
​
// Calculate the total real balance equivalent to the total supply
//@audit multiplying with index again
uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
//@audit Due to double multiplication with index in totalRealBalance, it always return 0.
return contractBalance <= totalRealBalance ? 0 : contractBalance - totalRealBalance;
}

Impact

  • Due to double multiplication, contractBalance will always be <= totalRealBalance, resulting in dust amount as zero.

  • This leads to dust accumulation in the contract, cannot withdraw dust anymore,

Tools Used

Manual Review

Recommendations

remove the second rayMul opereation in totalRealBalance calculation.

set totalRealBalance variable to currentTotalSupply.

​
totalRealBalance = currentTotalSupply.
​
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::calculateDustAmount incorrectly applies liquidity index, severely under-reporting dust amounts and permanently trapping crvUSD in contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!