Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Debt becomes unrepayable due to scaling mismatch

falendar

Summary

Users can burn all their DebtTokens through repayments while still owing debt due to index increases. This breaks debt accounting, making it impossible to repay the remaining debt and preventing users from closing liquidations, leaving them permanently stuck in liquidation state.

Vulnerability Details

Example scenario (crvUSD without decimals for simplicity):

User borrows 500 crvUSD (usageIndex = 1.1e27):

borrow function:
scaledAmount = (500 * 1e27) / (1.1 * 1e27) = 454.545 (rayDiv)
​
DebtToken's mint function:
user.index = 1.1 * 1e27
user receives 500 debt tokens
​
borrow function:
user receives 500 crvUSD
user.scaledDebtBalance = 454.545

User repays 500 crvUSD (usageIndex increases to 1.2e27):

repay function:
same amount (500) is passed to the burn function of DebtToken
​
DebtToken's burn function:
500 debt tokens burned
amountScaled = (500 * 1e27) / (1.2 * 1e27) = 416.666 (rayDiv)
returns amount = 500 and amountScaled = 416.666
​
repay function:
transfers amount (500 crvUSD) from user to reserve (RToken)
user.scaledDebtBalance = 454.545 - 416.666 = 37.879

User still has remaining debt (scaledDebtBalance = 37.879) that cannot be repaid because all debt tokens have been burned.

Impact

High: Users can burn all debt tokens while still owing debt. Remaining debt becomes unrepayable as there are no debt tokens to burn. Users cannot close liquidations due to remaining debt.

Recommendations

Align scaling logic between DebtToken and LendingPool.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.