Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Liquidity Index in balanceOf

lin0x9a7a

Summary

RToken's balanceOf function uses the global lending pool index instead of user-specific indices, allowing manipulation of token balances through index desynchronization.

Vulnerability Details

balanceOf uses ILendingPool(_reservePool).getNormalizedIncome() instead of the stored _userState[account].index.

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
// Uses global index instead of user's stored index
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
}

As can be seen, the balanceOf function uses the global liquidity index instead of user-specific indices, creating a fundamental mismatch between actual and reported token balances. This breaks the core accounting principle that user balances should reflect their specific deposit timing and interest accrual.

Worst-Case:

  • Users could extract excess tokens by timing transfers around index updates

  • Protocol could lose up to 100% of interest accrual through balance manipulation

  • System-wide accounting becomes unreliable, affecting all lending operations

This vulnerability mirrors the Compound Protocol's COMP distribution bug where incorrect index usage led to millions in excess token distributions. Both cases stem from index/accounting mismatches in DeFi protocols.

Impact

Balances may reflect the latest index instead of the user’s last updated index, leading to incorrect interest calculations.

Tools Used

vs

Recommendations

Use _userState[account].index for scaling individual balances.

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
uint256 userIndex = _userState[account].index;
return scaledBalance.rayMul(userIndex);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

RToken::balanceOf uses global liquidity index instead of user-specific indices, allowing interest calculation manipulation and breaking core accounting principles

Using the global liquidity index in balanceOf is the intended and correct behavior for interest-bearing tokens.

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

RToken::balanceOf uses global liquidity index instead of user-specific indices, allowing interest calculation manipulation and breaking core accounting principles

Using the global liquidity index in balanceOf is the intended and correct behavior for interest-bearing tokens.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.