Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

[H] Incorrect Calculation in `calculateRcrvUSDAmount` Function in `StabilityPool`

Singularity

Summary

The calculateRcrvUSDAmount function in the StabilityPool contract incorrectly calculates the amount of rToken to return for a given deToken redemption. The current calculation does not account for the difference in decimals between rToken and deToken, leading to incorrect amounts being returned.

Vulnerability Details

The current calculateRcrvUSDAmount function in the StabilityPool contract is:

function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10 ** (18 + rTokenDecimals - deTokenDecimals);
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor;
}
consider rToken is 18 decimals and deToken is 16 decimals that means 100 e18 of rToken = 100 e16 of deToken
example based on below formula for 100 e16 it must return 100 e18 but it returns 100 e14
scaling factor = 10 ** (18+18-16) = 10 ** 20 = 1e20
ret value = 100 e16 * 1e18 / 1e20 = 100 e14
so the calculation should be (deCRVUSDAmount * getExchangeRate()) / scalingFactor
based on this 100e16 * 1e20 / 1e18 = 100 e18

The current calculation does not correctly account for the difference in decimals between rToken and deToken, leading to incorrect amounts being returned. For example, if rToken has 18 decimals and deToken has 16 decimals, 100 e18 of rToken should equal 100 e16 of deToken. However, based on the current formula, for 100 e16 deToken, it must return 100 e18 rToken, but it returns 100 e14 rToken.

Impact

This issue can lead to incorrect amounts of rToken being returned for a given deToken redemption, potentially causing issues with token accounting and user balances within the protocol.

Tools Used

Manual code review.

Recommendations

Update the calculateRcrvUSDAmount function to correctly account for the difference in decimals between rToken and deToken. The corrected function should be:

function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10 ** (18 + rTokenDecimals - deTokenDecimals);
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor;
}

This ensures that the correct amount of rToken is returned for a given deToken redemption, leading to accurate token accounting and user balances.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Incorrect scaling factor formula in StabilityPool::calculateRcrvUSDAmount function

Both tokens have 18 decimals. Info

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.