Core Contracts

Summary

The RToken contract uses a calculation logic based on Aave's aToken index-based system. To do it, they override three critical functions:

1. transfer()

2. transferFrom()

3. _update()

Vulnerability Details

On transfer() function they use the rayDivfunction over the input amount and the normalizedIncome from the LendingPool. On transferFrom() they use the rayDiv function over the input amountand the _liquidityIndex. This inconsistency puts the protocol in an inconsistent state because they are different indexes and reflect different scenarios.

1. [transfer](https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/RToken.sol#L212-L215)

2. [transferFrom]()

Impact

Values that should be consistent through both functions will have different values according to the normalizedIncode and _liquidityIndex variation. E.g: if user A calls `transfer` user B will receive 1e18. If user B calls transferFrom to get the tokens from user A, he can receive 1e17 or 1e19, according to the variation between indexes. The difference can be way bigger due to protocol usage.

Tools Used

Code Review

Recommendations

Standardize the calculations using only the index that fits better the protocol design.