Description

The calculateRcrvUSDAmount function is designed to convert an amount of deCRVUSD (deToken) into an equivalent amount of rcrvUSD (rToken) using a scaling factor and an exchange rate. However, the scaling factor is calculated incorrectly as 10**(18 + rTokenDecimals - deTokenDecimals) instead of 10**(18 + deTokenDecimals - rTokenDecimals). This results in incorrect conversions, especially when the decimal places of the two tokens differ.

Impact

• Incorrect Token Conversions: Users redeeming deCRVUSD for rcrvUSD will receive incorrect amounts, leading to financial losses.

• Protocol Vulnerability: rToken balance will be drain

Root Cause

The scaling factor in calculateRcrvUSDAmount is calculated as:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/StabilityPool/StabilityPool.sol#L202

But in the calculateDeCRVUSDAmount the scaling factor is calculated as

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/StabilityPool/StabilityPool.sol#L192

Proof of Concept

Setup

1. Assume the following values for testing:

   • deTokenDecimals = 18 (e.g., deCRVUSD uses 18 decimal places, like ETH).

   • rTokenDecimals = 6 (e.g., rcrvUSD uses 6 decimal places, like USDC).

   • exchangeRate = 1e18 (1:1 exchange rate for simplicity).

2. A user deposit 100e18 units of rToken.

3. User redeem his deToken

This will drain rToken balance

The correct formula should be :

User would get

Fix

Update the scaling factor calculation in calculateRcrvUSDAmount to: