Core Contracts

Summary

The withdraw() function in the provided contract relies on ReserveLibrary.withdraw() to handle withdrawals. However, due to an incorrect return value in ReserveLibrary.withdraw(), the function misrepresents the actual amount of RTokens burned. This leads to:

Incorrect event logging

Potential liquidity mismanagement

Possible errors in external integrations relying on withdrawal events

Vulnerability Details

Root Cause (Incorrect Return Value in ReserveLibrary.withdraw())

Inside ReserveLibrary.withdraw(), the function incorrectly assigns amountUnderlying to amountWithdrawn:

return (amountUnderlying, burnedScaledAmount, amountUnderlying);

Instead of:

return (burnedScaledAmount, burnedScaledAmount, amountUnderlying);

Impact

Incorrect Event Emission (Withdraw Event Logs Wrong Data)

emit Withdraw(msg.sender, amountWithdrawn);

amountWithdrawn should represent burned RTokens, but instead, it represents amountUnderlying (the actual transferred asset amount).

Any external systems (indexers, analytics tools, or smart contracts) relying on this event will receive incorrect withdrawal data.

This could lead to mispriced rewards, incorrect accounting, or faulty tracking of burned RTokens.

Tools Used

Recommendations

Update the return values in ReserveLibrary.withdraw():

return (burnedScaledAmount, burnedScaledAmount, amountUnderlying);