Core Contracts

Summary

The RAAC protocol does not account for ERC20 tokens with transfer fees, leading to incorrect minting or burning of RTokens.

Vulnerability Details

When depositing or withdrawing tokens in the LendingPool, the protocol assumes the transferred amount equals the input amount. However, tokens with transfer fees, such as USDT, may deduct a fee during transfer, causing discrepancies in the actual amount received. For instance, in LendingPool.deposit(), the use of reserveAssetToken.safeTransferFrom() does not account for potential fees, leading to over-minting of RTokens.

Impact

This vulnerability can result in incorrect asset accounting, potentially causing protocol insolvency or loss of funds. If the protocol mints more RTokens than the actual amount of tokens received, it could lead to an imbalance in the system's financial stability.

The protocol's interaction with various ERC20 tokens, including potentially fee-on-transfer tokens like USDT, makes this a critical issue. The project's mention of using USDC and other ERC20 tokens in pools supports the relevance of this vulnerability.

Tools Used

• Manual review

Recommendations

Implement a check on the balance before and after the transfer to correctly account for the actual amount received. For example: