Core Contracts

Summary

The RToken contract applies normalized income scaling twice during transferFrom operations, dividing by the index value twice (in transferFrom and _update ) instead of once, resulting in reduced transfer amounts. The reduction becomes more severe as the index grows over time.

Vulnerability Details

The transferFrom function scales the transfer amountby dividing by the liquidity index.

However, _update also scales the already scaled amount, resulting in double scaling of the original transfer amount.

Impact

The actual transfer amount reduces as the index grows

Tools Used

Manual

Recommendations

The transferFrom amount should only be scaled once, in _update