Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing Interest Accrual on Repeated Deposits

thetripletail

Summary

The mint function in the RToken contract does not account for accrued interest on existing tokens when a user makes a repeated deposit. As a result, users lose out on earned interest when depositing additional funds into the protocol.

Vulnerability Details

The issue occurs in the mint function of the RToken contract. When a user deposits funds, the function calculates the accrued interest (balanceIncrease) on their existing tokens but fails to add this amount to the newly minted tokens (amountToMint). Instead, it only mints tokens equivalent to the deposited amount, ignoring the accrued interest.

function mint(
address caller,
address onBehalfOf,
uint256 amountToMint,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256, uint256) {
if (amountToMint == 0) {
return (false, 0, 0, 0);
}
uint256 amountScaled = amountToMint.rayDiv(index);
if (amountScaled == 0) revert InvalidAmount();
​
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
// @audit balanceIncrease is calculated but never used.
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
_mint(onBehalfOf, amountToMint.toUint128());
​
emit Mint(caller, onBehalfOf, amountToMint, index);
​
return (isFirstMint, amountToMint, totalSupply(), amountScaled);
}
​

Root Cause

The function calculates balanceIncrease (accrued interest) but does not include it in the amountToMint parameter passed to _mint. As a result, the accrued interest is effectively lost when a user makes a repeated deposit.

Impact

Users lose accrued interest on their existing tokens when making repeated deposits.

Tools Used

Manual code review.

Recommendation

To fix this issue, the accrued interest (balanceIncrease) should be added to the amountToMint before calling _mint.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

RToken::mint calculates balanceIncrease (interest accrued since last interaction) but never mints it, causing users to lose earned interest between deposits

The balanceIncrease is the interest that has already accrued on the user's existing scaledBalance since their last interaction. It's not something you mint as new tokens in the _mint function.

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

RToken::mint calculates balanceIncrease (interest accrued since last interaction) but never mints it, causing users to lose earned interest between deposits

The balanceIncrease is the interest that has already accrued on the user's existing scaledBalance since their last interaction. It's not something you mint as new tokens in the _mint function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.