Submission Details
Severity:
Modified `transferFrom()` in `RToken.sol` can lead to loss of user funds.
Summary
The transferFrom() function in RToken.sol is -
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
@-> return super.transferFrom(sender, recipient, scaledAmount);
}
user is transfering the funds with intention of only tranfering X amount, not [X/liquidityIndex]*10^27.
user will end up transfering additional amount as scaling happens under the hood/ he is not aware.
Vulnerability Details
Same as above.
Impact
User will loss funds unknowingly.
Tools Used
Manual
Recommendations
Let user know, how much exact amount he is paying.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.