The rToken Mint Function Ignores Calculated Interest, Leading to Under-Minting of Tokens
Summary
The mint() function calculates the additional balance from interest but fails to use it when minting tokens. This results in users receiving fewer tokens than they should.
Vulnerability Details
After computing the accrued interest, the code ignores balanceIncrease when calling _mint:
https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/RToken.sol#L136
While balanceIncrease is calculated earlier in the function, it is never factored into amountToMint, leading to under-minting. Essentially, the function recognizes extra accrued interest but does nothing with that information.
Impact
Users do not receive the full amount they are entitled to.
Creates an accounting mismatch, as the contract records interest accrual but does not properly distribute it.
Tools Used
Manual code review
Recommendations
Modify the mint() function to add balanceIncrease to amountToMint before minting tokens.
Lead Judging Commences
RToken::mint calculates balanceIncrease (interest accrued since last interaction) but never mints it, causing users to lose earned interest between deposits
The balanceIncrease is the interest that has already accrued on the user's existing scaledBalance since their last interaction. It's not something you mint as new tokens in the _mint function.
RToken::mint calculates balanceIncrease (interest accrued since last interaction) but never mints it, causing users to lose earned interest between deposits
The balanceIncrease is the interest that has already accrued on the user's existing scaledBalance since their last interaction. It's not something you mint as new tokens in the _mint function.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.