Core Contracts

Summary

The burn() function in the RToken contract contains two issues related to scaling and state updates:

1. The user’s stored liquidity index (_userState[from].index) is redundantly set twice within the function.

2. The variable amountScaled is calculated by multiplying the (unscaled) burn amount by the liquidity index via rayMul(index), even though the user's balance is already scaled. This results in a double scaling effect. Furthermore, the computed amountScaled is never used in the subsequent logic, making the calculation both unused and dangerous if it were relied upon in future updates.

Vulnerability Details

Impact

• Code Readability & Maintainability:
  The redundant assignment of _userState[from].index may confuse future maintainers, who might assume that each assignment serves a distinct purpose.

• Risk of Incorrect Behavior:
  The amountScaled calculation is performed incorrectly by scaling an already scaled balance (if the underlying logic follows a similar pattern as in the mint function). Although amountScaled is not used later in the function, any future modifications or refactoring that assume its correctness might inadvertently lead to excessive burning (or minting) of tokens, potentially causing a Denial of Service (DoS) attack.

Tools Used

Manual review

Recommendations

• Remove the Redundant Index Update:
  Only set _userState[from].index once at the appropriate point in the function.

• Review and Correct the Scaling Calculation:

  • Revisit the intended design: determine whether the burn amount should be scaled by the liquidity index or if the user's balance is already scaled.

  • Remove the extraneous multiplication (i.e., avoid using amount.rayMul(index) if the amount is already scaled), or perform the calculation on an unscaled value and store the result in a separate variable if necessary.