Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Balance Update Due to Scaled Amount Mismatch in Stability Pool Deposits

pelz

Summary

The deposit function in the Stability Pool incorrectly updates user balances based on the requested amount instead of the actual transferred amount. Since rToken operates with scaled balances, the recorded deposit amount can differ from what is actually received.

Vulnerability Details

The function deposit uses:

rToken.safeTransferFrom(msg.sender, address(this), amount);
userDeposits[msg.sender] += amount;

However, rToken scales transfers internally:

function _update(address from, address to, uint256 amount) internal override {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

This discrepancy means the user's recorded deposit might be inaccurate.

Impact

Users may have incorrect deposit balances, which can lead to miscalculations in rewards, withdrawals, or overall pool accounting.

Tools Used

Manual code review.

Recommendations

  • Use the actual transferred amount to update deposits:

    uint256 beforeBalance = rToken.balanceOf(address(this));
    rToken.safeTransferFrom(msg.sender, address(this), amount);
    uint256 afterBalance = rToken.balanceOf(address(this));
    uint256 actualReceived = afterBalance - beforeBalance;
    userDeposits[msg.sender] += actualReceived;

  • Ensure that reward calculations use the correct deposit amounts.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool's userDeposits mapping doesn't update with DEToken transfers or interest accrual, and this combined with RToken transfers causes fund loss and permanent lockup

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.