Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Scaling done twice, in transfer and transferFrom function in `RToken.sol`.

orangesantra

Summary

Contract - RToken.sol

function-flow -

transferFrom() -> super.transferFrom() -> _update -> super._update

function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}
function _update(address from, address to, uint256 amount) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
// @audit - scaledAmount has been scaled 2 times, once in the transferFrom function and once here.
// so it will cause loss and from sender and protocol both, beacuse of extra transfer
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

Similar kind of issue in calculateDustAmount() function as well,

  1. scaling is done in totalSupply() function.

  2. then again scaling is done via -

uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());

Vulnerability Details

  • The scaling of amount is already doen in parent caller function.

  • The scaling is done again in child function.

  • so, scaling is done 2 times.

Impact

Twice scaling will lead to prision issue. and incorrect accounting.

Tools Used

Manual

Recommendations

Remove one extra scaling.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!