Core Contracts

Vulnerability Details

At RToken::mint(), the token amount passed to _mint() is a normal token amount, this is not correct. It must be the scaled amount to properly account for interest.

For example when user does LendinPool::deposit() we see that the mint amount parameters is in token decimals, see deposit logic here, which calls reserve library here without altering the amount arg. Which will be just minted on RToken here.

Proof Of Concept

Why should it be the scaled amount? The AAVE book explains it pretty well, as RToken is a very similar re-creation to AAVE's aToken you can read here.

Summed up, when withdrawing the amount of balance of a user is multiplied by the current index, which accrues for all historical interest, yet we don't want that, we want to account only for the interest accrued since user deposited, thus when he deposits we discount the index by dividing it.

You can also check AAVE aToken code to see it should be the scaled amount, here. The contract just linked is inherited by aToken, see here.

Impact

Users are minted a higher amount than they should. This is just incorrect and would make all depositors to instantly accrue all interest since the beginning of the protocol.

Recommendations

You have to mint the scaledAmount. Which is already calculated a few lines above here.