Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

rToken transfer function always transfer double scaled amount

CODESPECT

Summary

rToken is an ERC20 with overridden transfer functions. When a user wants to transfer tokens, the amount gets scaled to account for the current liquidityIndex of the LendingPool. However, this amount also gets calculated at the overridden _update function, so the initial amount gets scaled 2 times instead of 1.

Vulnerability Details

rToken.sol
​
function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
@> uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}
​
function transferFrom(address sender, address recipient, uint256 amount)
public
override(ERC20, IERC20)
returns (bool)
{
@> uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}
function _update(address from, address to, uint256 amount) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
@> uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

The _update function in the ERC20 tokens gets used in the mint, burn and transfer functions to update the addresses' balances internally. In the mint and burn functions of rToken, the unscaled amount is correctly entered and gets scaled by the _update function. However, transfer functions also scale that amount before, so it gets scaled twice resulting in wrong amounts getting transferred.

Impact

In every transfer, wrong amount is actually getting transferred because the amount is getting scaled down twice.

Tools Used

Manual review

Recommendations

Remove the scaling from the transfer functions and allow only _update to calculate the scaled amount.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.