Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The RToken's Mint Function Returns Values in an Incorrect Order, Causing Compatibility Issues

victortheoracle

Summary

The mint function's return values are out of order, making them incompatible with expected outputs and can potentially lead to broken integrations.

Vulnerability Details

* @return A tuple containing:
* - bool: True if this is the first mint for the recipient, false otherwise
* - uint256: The amount of scaled tokens minted
* - uint256: The new total supply after minting
* - uint256: The amount of underlying tokens minted
*/

In the NatSpec, the documentation clearly states the expected return order as:

  1. isFirstMint

  2. amountScaled

  3. totalSupply()

  4. amountToMint

However, the actual return statement swaps amountScaled and amountToMint:

return (isFirstMint, amountToMint, totalSupply(), amountScaled);

In the ReserveLibrary contract, the deposit function relies on the return values of this mint function and expects the correct values but will end up using the wrong ones because of this incorrect order.

(bool isFirstMint, uint256 amountScaled, uint256 newTotalSupply, uint256 amountUnderlying) = IRToken(reserve.reserveRTokenAddress).mint(

Impact

External systems or contracts like the ReserveLibrary relying on the expected return order will misinterpret values and use them for the wrong calculations, leading to inconsistencies in the system.

Tools Used

  • Manual code review

Recommendations

Fix the return statement to match the documented order.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint doesn't return data in the right order, making the protocol emit wrong events

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint doesn't return data in the right order, making the protocol emit wrong events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.