Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Scaling done twice, in transfer and transferFrom function in `RToken.sol`.

orangesantra

Summary

Contract - RToken.sol

function-flow -

transferFrom() -> super.transferFrom() -> _update -> super._update

function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}
function _update(address from, address to, uint256 amount) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
// @audit - scaledAmount has been scaled 2 times, once in the transferFrom function and once here.
// so it will cause loss and from sender and protocol both, beacuse of extra transfer
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

Similar kind of issue in calculateDustAmount() function as well,

  1. scaling is done in totalSupply() function.

  2. then again scaling is done via -

uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());

Vulnerability Details

  • The scaling of amount is already doen in parent caller function.

  • The scaling is done again in child function.

  • so, scaling is done 2 times.

Impact

Twice scaling will lead to prision issue. and incorrect accounting.

Tools Used

Manual

Recommendations

Remove one extra scaling.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.