Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect Debt Comparison in Repayment Capping leading to Liquidations

DRUGstore

Summary

Exisiting logic in _repay function, Prevents full debt repayment .

Vulnerability Details

function _repay(uint256 amount, address onBehalfOf) internal {
...
uint256 userDebt = IDebtToken(reserve.reserveDebtTokenAddress).balanceOf(onBehalfOf);
uint256 userScaledDebt = userDebt.rayDiv(reserve.usageIndex);
uint256 actualRepayAmount = amount > userScaledDebt ? userScaledDebt : amount;
// Wrong comparison
}
​
//DebtToken::balanceOf function:
function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}

  • Compares repayment amount (in underlying asset terms) against userScaledDebt (scaled value)

  • Should compare against unscaled userDebt instead

  • Present comparison Caps repayments at scaled debt (userScaledDebt) instead of actual debt (userDebt)

Impact

  • actualRepayAmount will be capped at userScaledDebt which is far less than userDebt(actual debt of user).

  • This will prevent full debt repayment, leading to unnecesary liquidations, loss of user Collateral.

Recommendations

fix the following line in the _repay function:

function _repay(...){
..//remaining code
​
-- uint256 actualRepayAmount = amount > userScaledDebt ? userScaledDebt : amount;
++ uint256 actualRepayAmount = amount > userDebt ? userDebt : amount; //correct comparison
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

LendingPool::_repay caps actualRepayAmount at userScaledDebt instead of userDebt, preventing users from repaying full debt with interest in one transaction

That amount is not actually used.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!