Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RToken Burn Function Uses Unscaled Amount Leading to Excessive Token Burns

DRUGstore

Summary

The RToken contract's burn function uses the unscaled amount instead of the scaled amount when burning tokens, resulting in an incorrect number of tokens being burned and potential loss of user funds.

Vulnerability Details

The function calculates a scaled amount but ignores it, instead burning the raw amount. This means the number of RTokens burned doesn't account for the accumulated interest represented by the index.

Example:

  • User wants to burn equivalent of 100 underlying Tokens

  • Current index: 2.0 RAY

  • Should burn: 50 RTokens for 100 underlying tokens

  • Actually burns: 100 RTokens for 100 underlying tokens

function burn(
address from,
address receiverOfUnderlying,
uint256 amount,
uint256 index
) external override onlyReservePool returns (uint256, uint256, uint256) {
// ...
_burn(from, amount.toUint128()); // @audit incorrect: using amount instead of amountScaled
// ...
}
​

Impact

HIGH - Users losing RTokens. This vulnerability results in:

  1. Users losing more RTokens than they should when burning

  2. Misalignment between RToken supply and underlying asset reserve

Tools Used

Recommendations

Use the scaled amount in the burn operation.

-- _burn(from, amount.toUint128());
​
++ _burn(from, amountScaled.toUint128());
​
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::burn incorrectly burns amount (asset units) instead of amountScaled (token units), breaking token economics and interest-accrual mechanism

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::burn incorrectly burns amount (asset units) instead of amountScaled (token units), breaking token economics and interest-accrual mechanism

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.