Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Return Value in RToken Burn Function Leads to Protocol Insolvency

Zealynx

Description

The burn function in RToken.sol incorrectly returns the unscaled amount instead of the scaled amount. This function is critically used in two core protocol operations:

  • Debt Repayment (_repay function):

// LendingPool.sol
function _repay(uint256 amount, address onBehalfOf) internal {
// ...
(uint256 amountScaled, uint256 newTotalSupply, uint256 amountBurned) =
IDebtToken(reserve.reserveDebtTokenAddress).burn(onBehalfOf, amount, reserve.usageIndex);
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
}

  • Liquidation Finalization (finalizeLiquidation function):

// LendingPool.sol
function finalizeLiquidation(address userAddress) external {
// ...
(uint256 amountScaled, uint256 newTotalSupply, uint256 amountBurned) =
IDebtToken(reserve.reserveDebtTokenAddress).burn(userAddress, userDebt, reserve.usageIndex);
IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
}

The vulnerability exists in the burn implementation:

// RToken.sol
function burn(
address from,
address receiverOfUnderlying,
uint256 amount,
uint256 index
) external override onlyReservePool returns (uint256, uint256, uint256) {
uint256 amountScaled = amount.rayMul(index); // Calculated but never used
_burn(from, amount.toUint128());
// ...
return (amount, totalSupply(), amount); // Returns unscaled amount instead of amountScaled
}

The issue occurs because the index, which represents accumulated interest, is not factored into the returned amount. This affects both regular repayments and liquidations, making the protocol collect insufficient funds in both critical operations. Since the index naturally grows above RAY (1e27) as interest accumulates, this is a guaranteed issue in production.

Impact

The vulnerability has severe financial implications:

  1. Direct Protocol Losses:

    • At 5% APY after 1 year:

      Debt Repayment: 100,000 USDC
      Should Collect: 105,000 USDC
      Actually Collects: 100,000 USDC
      Loss: 5,000 USDC (5% loss per transaction)

    • Losses increase with time as the index grows

    • Every repayment and liquidation is affected

  2. Systemic Protocol Risks:

    • Protocol becomes increasingly undercollateralized

    • Interest rate calculations use incorrect amounts

    • Liquidation mechanisms collect insufficient collateral

    • Bad debt accumulates over time

  3. Timeline of Impact:

    • 1 week: ~0.1% loss per transaction

    • 1 month: ~0.4% loss per transaction

    • 6 months: ~2.5% loss per transaction

    • 1 year: ~5% loss per transaction

  4. Affected Parties:

    • Protocol: Loses value on every repayment

    • Depositors: Risk of insufficient collateral backing their deposits

    • Liquidators: Receive incorrect incentives

    • Overall protocol solvency is compromised

Recommended Mitigation

Immediate Fix

Modify the return statement in RToken.sol's burn function to return the scaled amount:

function burn(
address from,
address receiverOfUnderlying,
uint256 amount,
uint256 index
) external override onlyReservePool returns (uint256, uint256, uint256) {
uint256 amountScaled = amount.rayMul(index);
_burn(from, amount.toUint128());
// ...
return (amountScaled, totalSupply(), amount); // Return scaled amount
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::burn returns incorrect underlying asset amount (amount instead of amountScaled), leading to wrong interest rate calculations

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::burn returns incorrect underlying asset amount (amount instead of amountScaled), leading to wrong interest rate calculations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.