Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect balanceIncrease calculation in debtToken::mint function

DRUGstore

Summary

Vulnerability Details

The DebtToken contract contains a critical mathematical error in the calculation of balanceIncrease during minting operations. The current implementation fails to properly account for the fact that scaledBalance is already scaled by the current index inside balanceOffunction.
multiplying scaledBalance with index again is inflating the variable, which inflates balanceIncrease variable.

balance Increase= balance@index - balance@oldIndex

balance@index= scaledbalance

balance@oldIndex= (scaledBalance/index )* _userState[onBehalfOf].index

correct formula would be:

balanceIncrease = scaledBalance - (scaledBalance.rayMul(_userState[onBehalfOf].index).rayDiv(index))

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
@>> return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}
​
​
​
function mint(
address user,
address onBehalfOf,
uint256 amount,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256 ) {
.....//
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
//@audit scaledBalance is already result of .rayMul()
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
....//
}

Impact

With present formula of balanceIncrease, users are minted excessive Debt tokens than intended.
this is unfair to users.
Debt accounting is corrupted across the protocol.

Tools Used

Recommendations

//replace the faulty formula with the correct one:
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
//@audit scaledBalance is already result of .rayMul()
-- balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
++ balanceIncrease = scaledBalance - (scaledBalance.rayMul(_userState[onBehalfOf].index).rayDiv(index))
​
....//
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.