Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Inconsistent Conversion Between rToken and deToken

aksoy

Summary

The StabilityPool contract contains conversion functions that do not correctly handle tokens with differing decimal places. This can lead to inaccurate calculations when converting between rToken and deToken, potentially resulting in incorrect token amounts being returned or redeemed.

Vulnerability Details

The functions calculateDeCRVUSDAmount and calculateRcrvUSDAmount are responsible for converting amounts between rToken and deToken. These functions use a scalingFactor to adjust for differences in token decimals.

The scaling factor is calculated as 10**(18 + deTokenDecimals - rTokenDecimals) in calculateDeCRVUSDAmount and 10**(18 + rTokenDecimals - deTokenDecimals) in calculateRcrvUSDAmount. However, this approach can lead to incorrect conversions if the token decimals differ significantly.

function calculateDeCRVUSDAmount(uint256 rcrvUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
return (rcrvUSDAmount * scalingFactor) / getExchangeRate();
}
​
/**
* @notice Calculates the amount of rToken to return for a given deToken redemption.
* @param deCRVUSDAmount Amount of deToken to redeem.
* @return Amount of rToken to return.
*/
function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + rTokenDecimals - deTokenDecimals);
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor;
}


Example

  • rToken has 6 decimals.

  • deToken has 18 decimals.

  • getExchangeRate() returns 1e18.

For calculateDeCRVUSDAmount:

  • scalingFactor = 10``(18 + 18 - 6) = 10e30

  • If rcrvUSDAmount =1e6 , the function returns (1e6 * 10**30) / 1e18 = 10**18.

For calculateRcrvUSDAmount:

  • scalingFactor = 10**(18 + 6 - 18) = 10**6

  • If deCRVUSDAmount = 1e18, the function returns (1e18 * 1e18) / 10**6 = 10**30.

same deCRVUSDAmountis not correctly converted to initial amount

Impact

Withdraw would fail since it would try to send much more rTokens than user balance

Tools Used

Manual

Recommendations

To fix the inconsistency, update the calculateRcrvUSDAmount function so that it uses the same scaling factor as calculateDeCRVUSDAmount

function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
// Use same exponent: 10^30 for 18 and 6 decimals
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Incorrect scaling factor formula in StabilityPool::calculateRcrvUSDAmount function

Both tokens have 18 decimals. Info

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.