Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`mint()` function in `DebtToken` contract mints excessive debt tokens

cipher27

Summary

The mint() function incorrectly calculates the amount of debt tokens to mint by adding both unscaled amount and balance increase.

Vulnerability Details

The issue occurs in the mint() function where the minting amount calculation is incorrect.

File: DebtToken.sol
147: uint256 amountScaled = amount.rayDiv(index);
148: if (amountScaled == 0) revert InvalidAmount();
149:
150: uint256 scaledBalance = balanceOf(onBehalfOf);
151: bool isFirstMint = scaledBalance == 0;
152:
153: uint256 balanceIncrease = 0;
154: if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
155: balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
156: }
157:
158: _userState[onBehalfOf].index = index.toUint128();
159:
160: uint256 amountToMint = amount + balanceIncrease;
161:
162: _mint(onBehalfOf, amountToMint.toUint128());

The function adds the unscaled amount with balanceIncrease instead of using the amountScaled value, which leads to minting excessive debt tokens for borrowers.

Impact

All borrowers receive significantly more debt tokens than they should when borrowing against their collateral, leading to systematic loss of funds.

Recommendations

The mint() function should use amountScaled instead of amountToMint when calling the _mint() function to ensure correct debt token minting.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!