Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Double Scaling in Repayment Leads to Residual Debt

0x23r0

Summary

The _repay function incorrectly applies scaling twice to the repayment amount, resulting in underpayment of debt. This leaves residual debt even when users attempt full repayment, violating core protocol invariants and leading to unexpected liquidations or collateral lockups.

Vulnerability Details

The _repay function calculates scaledAmount by applying rayDiv to actualRepayAmount, which is already a scaled if the actualRepayAmount = userScaledDebt we must not scaled this value again because it's already scaled. This double scaling reduces the effective repayment amount, preventing full debt clearance.

function _repay(uint256 amount, address onBehalfOf) internal {
if (amount == 0) revert InvalidAmount();
if (onBehalfOf == address(0)) revert AddressCannotBeZero();
​
UserData storage user = userData[onBehalfOf];
​
// Update reserve state before repayment
ReserveLibrary.updateReserveState(reserve, rateData);
​
// Calculate the user's debt (for the onBehalfOf address)
uint256 userDebt = IDebtToken(reserve.reserveDebtTokenAddress).balanceOf(onBehalfOf);
@>> uint256 userScaledDebt = userDebt.rayDiv(reserve.usageIndex);
​
// If amount is greater than userDebt, cap it at userDebt
@>> uint256 actualRepayAmount = amount > userScaledDebt ? userScaledDebt : amount;
​
@>> uint256 scaledAmount = actualRepayAmount.rayDiv(reserve.usageIndex);
​
//...
}

Impact

The value of scaledAmount is wrong because of double scaling

Tools Used

Manual Review

Recommendations

Remove redundant scaling by directly using actualRepayAmount:

// Before (incorrect)
uint256 scaledAmount = actualRepayAmount.rayDiv(reserve.usageIndex);
​
// After (correct)
uint256 scaledAmount = actualRepayAmount;
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

LendingPool::_repay double scales the debt

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

LendingPool::_repay double scales the debt

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.