Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Double Scaling Total Supply in transferAccruedDust

aksoy

Summary

The transferAccruedDust function in the RToken contract is not working correctly due to an error in the calculation of the dust amount. The calculation involves multiplying the total supply by the liquidity index twice, leading to an inflated real balance and preventing the correct transfer of dust.

Vulnerability Details

The issue arises in the calculateDustAmount function, where the totalSupply is already scaled by the liquidity index. The totalRealBalance is then calculated by multiplying this already scaled totalSupply by the liquidity index again. This results in an inflated totalRealBalance, which is higher than necessary.

For example, if the asset amount is 110 and the scale index is 1.1, the mint amount would be 100, and the total supply would be 110. However, the totalRealBalance would be calculated as 110 * 1.1, which is higher than it should be. Consequently, the dust amount cannot be transferred correctly.

function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
return super.totalSupply().rayMul(ILendingPool(_reservePool).getNormalizedIncome());
}
​
​
function calculateDustAmount() public view returns (uint256) {
// Calculate the actual balance of the underlying asset held by this contract
uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this)).rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
​
// Calculate the total real obligations to the token holders
uint256 currentTotalSupply = totalSupply();
​
// @audit this is already multiplied
uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
// All balance, that is not tied to rToken are dust (can be donated or is the rest of exponential vs linear)
return contractBalance <= totalRealBalance ? 0 : contractBalance - totalRealBalance;
}
​

Impact

The incorrect calculation of the dust amount leads to the inability to transfer the actual dust balance

Tools Used

Manual

Recommendations

To fix the issue, adjust the calculation of the totalRealBalance in the calculateDustAmount function. Ensure that the totalSupply is not scaled by the liquidity index more than once.

uint256 totalRealBalance = currentTotalSupply;
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::calculateDustAmount incorrectly applies liquidity index, severely under-reporting dust amounts and permanently trapping crvUSD in contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.