Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong calculation of burned tokens

revcrew777

Summary

burn() function in RToken contract calculates wrong amount to burn tokens. It was missed to calculate the interest and then the interest to be added to amount. Also the first param in the return - amount, should be in scaled units.

Vulnerability Details

The function is expected to return:
- @return A tuple containing:\

- uint256: The amount of scaled tokens burned

- uint256: The new total supply after burning

- uint256: The amount of underlying asset transferred

It returns interest-free amount non scaled, total supply and interest-free amount.

Impact

The function withdraw in ReserveLibrary contract calls burn function from RToken contract.

// Burn RToken from the recipient - will send underlying asset to the recipient
(uint256 burnedScaledAmount, uint256 newTotalSupply, uint256 amountUnderlying) = IRToken(reserve.reserveRTokenAddress).burn(
recipient, // from
recipient, // receiverOfUnderlying
amount, // amount
reserve.liquidityIndex // index
);
amountWithdrawn = burnedScaledAmount;
// Update the total liquidity and interest rates
updateInterestRatesAndLiquidity(reserve, rateData, 0, amountUnderlying);
​
emit Withdraw(recipient, amountUnderlying, burnedScaledAmount);
​
return (amountUnderlying, burnedScaledAmount, amountUnderlying);

burnedScaledAmount and amountUnderlying variables will be with not correct. They will be interest-free values and burnedScaledAmount will be not scaled.

Recommendations

To fix the issue first it should be added this part of code in burn() function in RToken after receiving the userBalance at row 164:

uint256 balanceIncrease = 0;
if (_userState[from].index != 0 && _userState[from].index < index) {
uint256 borrowIndex = ILendingPool(_reservePool).getNormalizedDebt();
balanceIncrease = userBalance.rayMul(borrowIndex) - userBalance.rayMul(_userState[from].index);
amount += balanceIncrease;
}
​

and then the return should looks like:

return (amountScaled, totalSupply(), amount);
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::burn incorrectly burns amount (asset units) instead of amountScaled (token units), breaking token economics and interest-accrual mechanism

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::burn incorrectly burns amount (asset units) instead of amountScaled (token units), breaking token economics and interest-accrual mechanism

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.