Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The computed balance increase is wrong in the Debt Token

0xphantom

Summary

In the debt token the computated balance increase is wrong making the event Mint is wrong.

Vulnerability Details

In the mint function of the Debt Token the the protocol compute the balance increase due to the change of the usage index and emit an event that use this value as we can see here :

uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
...code
emit Mint(user, onBehalfOf, amountToMint, balanceIncrease, index);

The problem is that the protocol use the function balanceOf and that return an unscaled amount as we can see here :

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}
​

The function will therefore multiplied the balance by the index two times which will make the computation to be totally wrong.

Impact

the event emitted will be wrong.

Tools Used

Manual review

Recommendations

The protocol should use the scaled balance to make the computation.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.