Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`RToken::transfer` & `RToken::transferFrom` amounts have duplicated `rayDiv` calculations leading to unexpected balance updates

77SecMentees

Summary

The RToken contract uses a calculation logic based on Aave's aToken index-based system. To do it, they override three critical functions:

  1. transfer()

  2. transferFrom()

  3. _update()

Vulnerability Details

To attend mint()and burn() functions, the protocol overrides the _update() function so they can convert the input amount into scaladAmount. The problem is that transfer() and transferFrom() functions also use the update function and convert the amount into scaledAmount internally, before forwarding*. This cause the* scaledAmount forwarded by the transfer() and transferFrom() to be re-scaled on the update() function.

transfer

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}

transferFrom

function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}

_update

function _update(address from, address to, uint256 amount) internal override {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

Impact

It will generate big discrepancies between real values and expected values, breaking the protocol functionality.

Tools Used

Code Review

Recommendations

Remove the conversion from the transferFromand transferfunctions, centralizing the conversion inside of _updatefunction.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!