Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect use of ``balanceOf()`` in the ``mint()`` lead to mint more of DebtToken

makriss

Summary

balanceIncrease is miscalculated due to an extra multiplication by index.

Vulnerability Details

DebtToken.sol in function mint : https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/DebtToken.sol#L136

uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
uint256 amountToMint = amount + balanceIncrease;
​
_mint(onBehalfOf, amountToMint.toUint128());

so to calculate balanceIncrese it substruct a scaledBalance * userIndex from scaledBalance * index but scaledBalance is already multipled by index because it was taken from balanceOf().

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());

so what the function do is :
(scaledBalance×index×index)−(scaledBalance×index×oldIndex)

Which results in double multiplication by index, and minting more tokens and the user will pay debt

Root Cause

  • balanceOf(onBehalfOf) already includes a multiplication by index.

  • Multiplying again results in an overestimated balanceIncrease.

Impact

  • Over-minting of tokens

  • Incorrect user balances

Tools Used

Manual Review

Recommendations

use super.balanceOf(), instead of balanceOf()

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!