Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect Interest Accrual in DebtToken: Linear Instead of Compounding

thetripletail

Summary

The mint function in the DebtToken contract incorrectly calculates interest using a linear formula Δbalance = balance * (index_current - index_last), while the protocol's documentation explicitly states that debt should accrue using compounding interest. This discrepancy results in incorrect interest calculations, leading to financial inefficiencies for the protocol and unfair treatment of users

Vulnerability Details

The issue is located in the mint function of the DebtToken contract. Specifically, the calculation of balanceIncrease is implemented as follows:

if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
// Δbalance = balance * (index_current - index_last)
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}

This formula calculates interest linearly, as it multiplies the scaledBalance by the difference between the current and previous indices (index - lastIndex). However, the protocol's documentation states:

"While the debt accruing is compounding, the liquidity rate is linear."

This indicates that debt should accrue using compounding interest, not linear interest.

Impact

Financial Loss for the Protocol:

The protocol will overcharge interest on debt, leading to increased costs for the protocol. This could result in reduced profitability and financial instability.

Calculation proofs:

// let usageIndex change 1.0 -> 1.2 -> 1.44
​
// Linear (current) formula
balanceIncrease = 100 * (1.2 - 1.0) = 20;
newBalance = 100 + 20 = 120;
​
balanceIncrease = 120 * (1.44 - 1.2) = 28.8;
newBalance = 120 + 28.8 = 148.8; // incorrect result
​
// Compounded formula
balanceIncrease = 100 * (1.2 / 1.0) - 100 = 20;
newBalance = 100 + 20 = 120;
​
balanceIncrease = 120 * (1.44 / 1.2) - 120 = 24;
newBalance = 120 + 24 = 144; // correct result

Unfair Outcomes for Users:

Borrowers will pay more interest than they should, which may discourage borrowing and reduce the protocol's usage. This creates an unfair disadvantage for users.

Tools Used

Manual code review.

Recommendations

To fix this issue, replace the linear interest calculation with a compounding interest formula. Update the balanceIncrease calculation as follows:

if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
// Δbalance = balance * (index_current / index_last) - balance
balanceIncrease = scaledBalance.rayMul(index.rayDiv(_userState[onBehalfOf].index)) - scaledBalance;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.