Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Unprotected debt token burning in `transfer()` and `transferFrom()`

cipher27

Summary

The DebtToken contract allows users to burn their debt tokens directly through transfer functions.

Vulnerability Details

The _update() function implementation shows the transfer restriction so that borrowers can't burn their debt tokens directly.

function _update(address from, address to, uint256 amount) internal virtual override {
if (from != address(0) && to != address(0)) {
revert TransfersNotAllowed(); // Only allow minting and burning
}
​
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
super._update(from, to, scaledAmount);
emit Transfer(from, to, amount);
}

But this function doesn't revert when to is address(0), allowing users to burn their debt tokens by transferring their debt tokens to address(0).

As a result, the borrowers will be treated as they have repaid their debt, which breaks the protocol's main functionality.

Impact

Users can burn their debt tokens directly without repaying their debt making the protocol insolvent.

Recommendations

Modify the _update() function to ensure only the lending pool can burn debt tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken permits burning via transfer to address(0), breaking protocol accounting and making debt repayment impossible, permanently locking collateral

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken permits burning via transfer to address(0), breaking protocol accounting and making debt repayment impossible, permanently locking collateral

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!