Core Contracts

Summary

The mint() function in the RToken contract returns a tuple containing (isFirstMint, amountToMint, totalSupply(), amountScaled). However, the ReserveLibrary of the lending pool expects the return values in the order of (isFirstMint, amountScaled, newTotalSupply, amountUnderlying). This discrepancy misaligns the expected values, causing incorrect handling of deposit amounts.

Vulnerability Details

Inside the `ReserveLibrary.deposit()`, RToken is minted for the depositor. The problem here is the return value order of this function:

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/libraries/pools/ReserveLibrary.sol#L337-L342

However, the RToken mint() function returns the amountUnderlying and amountScaled in wrong order:

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/tokens/RToken.sol#L140

1. User A deposits 1,000 tokens into the lending pool.

2. The mint() function computes:

Suppose usageIndex = 1.1e27, then:

1. The function mint() returns:

(true, 1000, 1_000_000, 909)

1. But ReserveLibrary expects the following order:

(true, 909, 1_000_000, 1000)

1. Due to the swapped values, the system mistakenly treats 909 as amountUnderlying instead of amountScaled, leading to minting incorrect amounts of Rtokens.

Impact

Since amountScaled and amountUnderlying are displaced, deposited amounts may be incorrectly recorded in the lending pool.

Tools Used

Manual

Recommendations

Consider modifying the RToken minting mechanism and return values which are used inside the ReserveLibrary contract.