Submission Details
Severity:
Amounts returned in mint function form RToken are switched
Vulnerability Details
In IRToken docs we can see that the second arg of the mint function returns scaled amount and the last arg the underlying amount.
See here.
But it is coded in reverse on the RToken contract, see here:
return (isFirstMint, amountToMint, totalSupply(), amountScaled);
Impact
Incorrect implementation as per docs. Fortunately these return values were not used for anything critical.
Recommendations
Switch the return args on the mint function.
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
RToken::mint doesn't return data in the right order, making the protocol emit wrong events
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
RToken::mint doesn't return data in the right order, making the protocol emit wrong events
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.