Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Wrong amount for Burn event in DebtToken::burn function

y0ng0p3

Vunerability Details

As it can be seen in DebtToken.sol, the event Burn is defined as:

File: contracts/core/tokens/DebtToken.sol#L63-L69
​
/**
* @notice Emitted when debt tokens are burned
* @param from The address from which tokens are burned
* @param amount The amount burned (in underlying asset units)
* @param index The usage index at the time of burning
*/
event Burn(address indexed from, uint256 amount, uint256 index);

However, in the DebtToken::burn function, the second argument is amountScaled instead of `amount.

File: contracts/core/tokens/DebtToken.sol#L211
​
emit Burn(from, amountScaled, index);

Impact

Off-chain listeners may use/display incorrect values and potentially mislead users.
Especially as the usage index of reserve is emitted allong with the amount, which suggests that the listener could use them to calculate the scaled amount the borrower paid to burn his debt tokens.

Tools used

Manual review.

Recommendations

Use amount instead of amountScaled.

File: contracts/core/tokens/DebtToken.sol#L211
​
- emit Burn(from, amountScaled, index);
+ emit Burn(from, amount, index);
}

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::burn emits Burn event with scaled amount instead of raw amount, contradicting documentation and causing incorrect off-chain data

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::burn emits Burn event with scaled amount instead of raw amount, contradicting documentation and causing incorrect off-chain data

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.