Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Mismatch in mint return values

0xisboss

Overview

users are currently able to deposit funds in to the protocol by calling the deposit function

function deposit(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
// Update the reserve state before the deposit
ReserveLibrary.updateReserveState(reserve, rateData);
​
// Perform the deposit through ReserveLibrary
uint256 mintedAmount = ReserveLibrary.deposit(reserve, rateData, amount, msg.sender);
​
// Rebalance liquidity after deposit
_rebalanceLiquidity();
​
emit Deposit(msg.sender, amount, mintedAmount);
}

It calls the internal deposit function which has the mint functionality below

// Mint RToken to the depositor (scaling handled inside RToken)
(bool isFirstMint, uint256 amountScaled, uint256 newTotalSupply, uint256 amountUnderlying) = IRToken(reserve.reserveRTokenAddress).mint(
address(this), // caller
depositor, // onBehalfOf
amount, // amount
reserve.liquidityIndex // index
);

As it is seen it is expected that the mint will return (bool isFirstMint, uint256 amountScaled, uint256 newTotalSupply, uint256 amountUnderlying) in that order

However, when we look at the mint it returns the values

return (isFirstMint, amountToMint, totalSupply(), amountScaled);

This means that the amountToMint is in place of amountScaled and should be interchanged for correct return values
Wrong return values will lead to incorrect calculations which lead to losses

Impact

wrong values returned

Recommendation

Return values in their correct places to avoid incorrect computations

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint doesn't return data in the right order, making the protocol emit wrong events

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::mint doesn't return data in the right order, making the protocol emit wrong events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.