Core Contracts

Summary

The RToken contract's mint function returns values in an incorrect sequence compared to its documented return specification. This mismatch between documentation and implementation can lead to incorrect interpretations by calling contracts, particularly the LendingPool, potentially causing accounting errors in the protocol.

Vulnerability Details

LendingPool::deposit --> ReserveLibrary:deposit --> RToken.mint()

LendingPool & ReserveLibrary expect amountScaled but instead recieve amountToMint.

Impact

severity: HIGH (Likelihood: Always, Impact: High )

1. The LendingPool contract receives amountToMint when it expects amountScaled in the second position

2. Since scaled amounts are used to track user balances and protocol accounting, this leads to:

   1. Incorrect user balance calculations

   2. Inaccurate interest accrual

   3. Potential loss of funds due to miscalculated withdrawals

Tools Used

Recommendations

Modify the return statement to return correct sequence, as expected.

return (isFirstMint, amountScaled, totalSupply(), amountToMint);