Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect use of ``balanceOf()`` in the ``mint()`` lead to mint more of DebtToken

makriss

Summary

balanceIncrease is miscalculated due to an extra multiplication by index.

Vulnerability Details

DebtToken.sol in function mint : https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/DebtToken.sol#L136

uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
uint256 amountToMint = amount + balanceIncrease;
​
_mint(onBehalfOf, amountToMint.toUint128());

so to calculate balanceIncrese it substruct a scaledBalance * userIndex from scaledBalance * index but scaledBalance is already multipled by index because it was taken from balanceOf().

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());

so what the function do is :
(scaledBalance×index×index)−(scaledBalance×index×oldIndex)

Which results in double multiplication by index, and minting more tokens and the user will pay debt

Root Cause

  • balanceOf(onBehalfOf) already includes a multiplication by index.

  • Multiplying again results in an overestimated balanceIncrease.

Impact

  • Over-minting of tokens

  • Incorrect user balances

Tools Used

Manual Review

Recommendations

use super.balanceOf(), instead of balanceOf()

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.