Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`scaledBalance` is caled twice, causing the borrower to pay more

pyro

Summary

Balances are scaled twice in a row, minting too much debt tokens to the user.

Vulnerability Details

Inside mint we use scaledBalance to calculate the balance increase, where we scaled it by the index - scaledBalance.rayMul(index) in order to convert it from debtToken to rToken and calculate the increase in interest before minting this together with the amount.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/tokens/DebtToken.sol#L150

uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
// balance * curent index - balance * old index
​
// scaledBalance * index / 1e27 - scaledBalance * _userState[onBehalfOf].index / 1e27
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
uint256 amountToMint = amount + balanceIncrease;
​
_mint(onBehalfOf, amountToMint.toUint128());

However the issue is that balance already scales that amount to rToken, by using rayMul

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/tokens/DebtToken.sol#L223

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
​
// scaledBalance * ILendingPool(_reservePool).getNormalizedDebt() / 1e27
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}

In the end we scale the balance twice before taking the index diff which will result in higher amounts of tokens being minted to the borrower, thus making him repay too much debt.

Impact

Borrower pays more debt than it owns us

Tools Used

Manual review

Recommendations

Don't scale the balance twice.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!