Core Contracts

Summary

The RToken's mint function fails to include accrued interest (balanceIncrease) when emitting the Mint event, causing inaccurate tracking of actual tokens minted to users.

Vulnerability Details

RToken uses a scaled balance system where users receive additional tokens through interest accrual. When minting new tokens to a user who already has a balance, the function calculates both:

1. New tokens to mint (amountToMint)

2. Interest accrued on existing balance (balanceIncrease)

However in the current implementation, RToken::mint

The issue is that the Mint event only includes amountToMint, omitting balanceIncrease.

PoC

1. Alice has 100 RTokens

2. Interest accrues (10%)

3. Alice mints 50 more RTokens

4. She receives 60 tokens (50 new + 10 interest)

5. Event only shows 50 tokens minted

Impact

Incorrect accounting in systems relying on Mint events to track token distribution.

Tools Used

Manual review

Recommendations

or u could also add a separate parameter for the balanceIncrease variable in the Mint event