Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Scaling Factor in StabilityPool Token Conversion

waydou

Summary

The StabilityPool contract contains an incorrect scaling factor calculation in the calculateRcrvUSDAmount function, which is used when converting deTokens back to rTokens during withdrawals. This leads to incorrect token conversion calculations and potential value loss for users.

Vulnerability Details

The StabilityPool implements two conversion functions for depositing and withdrawing:

// Used for deposits (rToken -> deToken)
function calculateDeCRVUSDAmount(uint256 rcrvUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
return (rcrvUSDAmount * scalingFactor) / getExchangeRate();
}
​
// Used for withdrawals (deToken -> rToken)
function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + rTokenDecimals - deTokenDecimals); // INCORRECT
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor;
}

The issue is that calculateRcrvUSDAmount uses an incorrect inverse scaling factor. For the conversion to be symmetrical:

  1. Both functions should use the same scaling factor

  2. The withdrawal function should multiply by exchange rate and divide by the same scaling factor

  3. Instead, it uses a different scaling factor that doesn't properly reverse the deposit calculation
    In the calculation the output will have the following decimals 2* deTokenDecimals - rTokenDecimals instead of rTokenDecimals.

Impact

This vulnerability results in:
Incorrect conversion of deTokens back to rTokens during withdrawals
Users receiving wrong amounts when withdrawing

Tools Used

Manual Review

Recommendations

Fix the scaling factor:

function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals); // SAME as deposit
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Incorrect scaling factor formula in StabilityPool::calculateRcrvUSDAmount function

Both tokens have 18 decimals. Info

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!