Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect amount is burned in Debt token contract

DRUGstore

Summary

burn function of DebtToken contract, burns incorrect amount of debtTokens. Input argument amountis in terms of asset Tokens, so amountScaled would be the corresponding Debt Token amount.

Instead of burning amountScaled, function burns amount, causing loss of funds to protocol.

Vulnerability Details

The `burn` function improperly uses raw amount instead of scaled debt amount (`amountScaled`) when burning debt tokens:

function burn(
address from,
uint256 amount,
uint256 index
) external override onlyReservePool returns (uint256, uint256, uint256, uint256)
{
......
uint256 amountScaled = amount.rayDiv(index);
​
if (amountScaled == 0) revert InvalidAmount();
​
_burn(from, amount.toUint128()); //@audit should be amountScaled
emit Burn(from, amountScaled, index);

Impact

Whenever users repay the debt in partial amounts, It causes Over-burning of DebtTokens (if interest has accrued, index > 1), which causes loss of funds to the protocol.
users will pay lesser debt than they have to. Can be exploited by malicious attackers to steal funds from protocol.

Tools Used

Manual review

Recommendations

burn amountScaled instead of amount.

_burn(from, amountScaled.toUint128());
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::burn incorrectly burns amount (asset units) instead of amountScaled (token units), breaking token economics and interest-accrual mechanism

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::burn incorrectly burns amount (asset units) instead of amountScaled (token units), breaking token economics and interest-accrual mechanism

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!