Summary

The totalSupply() function in the DebtToken contract incorrectly calculates the total supply by using rayDiv instead of rayMul to adjust the scaledSupply with the normalized debt. This discrepancy leads to an incorrect total supply value, affecting the protocol's accounting and overall financial integrity.

Vulnerability Details

Incorrect use of rayDiv instead of rayMul.

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/DebtToken.sol#L234

The function should multiply the scaledSupply by the normalized debt using rayMul to derive the correct total supply.

• Actual Behavior:
  The function divides the scaledSupply by the normalized debt using rayDiv, resulting in an incorrect total supply value.

Impact

1. Incorrect Total Supply

   • The total supply returned by the function will be significantly lower than the actual value, as division reduces the scaled supply again instead of scaling it up.

2. Accounting Errors:

   • Incorrect total supply calculations lead to inconsistencies in the protocol's financial accounting, making it difficult to track the actual token supply and user balances.

This two-part will be affected, and the total usage of the reserve will be incorrectly set, impacting all financial operations like borrowIndex.

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L360

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L424

Mitigation

To fix this issue, the totalSupply() function should be updated to use rayMul instead of rayDiv. Here is the corrected code: