Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect balanceIncrease calculation in debtToken contract

DRUGstore

Summary

the burn() function in DebtToken contract, calculates balanceIncrease which is part of return tuple.

Vulnerability Details

userBalanceis already scaled as balanceOf()function already internally multiplies with the index.
multiplying userBalanceagain in balanceIncreasecalculation is incorrect, it over inflates the variable wrongly.

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
// already multiplied with index.
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}
​
function burn(
address from,
uint256 amount,
uint256 index
) external override onlyReservePool returns (uint256, uint256, uint256, uint256) {
if (from == address(0)) revert InvalidAddress();
if (amount == 0) {
return (0, totalSupply(), 0, 0);
}
​
uint256 userBalance = balanceOf(from); //@audit already scaled.
​
uint256 balanceIncrease = 0;
if (_userState[from].index != 0 && _userState[from].index < index) {
uint256 borrowIndex = ILendingPool(_reservePool).getNormalizedDebt(); //;usage index
//@audit wrong formula userBalance is already Scaled.
balanceIncrease = userBalance.rayMul(borrowIndex) - userBalance.rayMul(_userState[from].index);
amount = amount;
}

Impact

due to double multiplication with index, balanceIncrease variable stores inflated value. this can cause further accounting problem wherever balanceIncrease variable is used.

Tools Used

manual review

Recommendations

adjust the balanceIncrease calculations correctly. divide the userbalance with the index before multiplying with another index.
for example:

balanceIncrease = userBalance* (borrowIndex - _userState[from].index) / borrowIndex

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!