Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

The `burn()` function does NOT `mint` `balanceIncrease`

sunless_

Summary

Function burn() in debtToken, while computing balanceIncrease does not mint such increase in tokens. This increase represents accumulated interest which the user is supposed to pay, so they should be increased like they did in the mint() function.

Vulnerability Details

Consider looking into the mint() function mint(), you'll find that the balanceIncrease is added to the amount, while it is correct incase of minting tokens, but when burning tokens, the function burn() simply does NOT do anything with the balanceIncrease i.e. burn()

if (_userState[from].index != 0 && _userState[from].index < index) {
​
uint256 borrowIndex = ILendingPool(_reservePool).getNormalizedDebt(); //*gets the reserve.UsageIndex
​
balanceIncrease = userBalance.rayMul(borrowIndex) - userBalance.rayMul(_userState[from].index);
​
amount = amount; // this should be removed from here
​
}

As the balanceIncrease represents accumulated interest due to difference in usage index, it should be minted to the user.

Impact

Tokens representing accumulated interest are not minted to the Users

Tools Used

Manual

Recommendations

Consider adding this instead:

​
balanceIncrease = userBalance.rayMul(borrowIndex) - userBalance.rayMul(_userState[from].index);
​
_mint(from, balanceIncrease.toUint128());
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken::burn calculates balanceIncrease (interest) but never applies it, allowing borrowers to repay loans without paying accrued interest

Interest IS applied through the balanceOf() mechanism. The separate balanceIncrease calculation is redundant/wrong. Users pay full debt including interest via userBalance capping.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken::burn calculates balanceIncrease (interest) but never applies it, allowing borrowers to repay loans without paying accrued interest

Interest IS applied through the balanceOf() mechanism. The separate balanceIncrease calculation is redundant/wrong. Users pay full debt including interest via userBalance capping.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!