Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Amount Used in RToken Mint Function Leading to Excess Token Minting

DRUGstore

Summary

The RToken contract's mint function contains a critical vulnerability where it uses the unscaled amount (amountToMint) instead of the scaled amount (amountScaled) when minting tokens. This results in users receiving more RTokens than they should, leading to protocol fund loss.

Vulnerability Details

In RToken contract, mint function:

The function correctly calculates the scaled amount by dividing amountToMint by the liquidity index using ray math (27 decimal precision). However, it then incorrectly uses the original amountToMint value in the _mint function instead of the calculated amountScaled value.

function mint(
address caller,
address onBehalfOf,
uint256 amountToMint, //; would be in crvUSD terms.
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256, uint256) {
.....
uint256 amountScaled = amountToMint.rayDiv(index);
_mint(onBehalfOf, amountToMint.toUint128()); // @audit uses amountToMint instead of amountScaled
....
}

Impact

HIGH - The vulnerability leads to direct fund loss for the protocol

  1. Users receive more RTokens than they should based on their deposited collateral

  2. These excess RTokens represent claims on the underlying assets that exceed the actual deposited amount

  3. When users redeem their RTokens, they can withdraw more funds than they should be entitled to

  4. This creates a deficit in the protocol's reserves, potentially leading to insolvency

Tools Used

Manual review

Recommendations

Modify the mint function to use the scaled amount:

​
uint256 amountScaled = amountToMint.rayDiv(index);
_mint(onBehalfOf, amountScaled.toUint128()); // Fix: use scaled amount
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint should mint the amountScaled not the amountToMint

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint should mint the amountScaled not the amountToMint

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.