Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Pre-Mint Balance Check for deToken

ibukunola

Summary

The deposit() function mints deToken without ensuring sufficient crvUSD reserves, risking over-issuance if reserves are depleted. This medium-impact, medium-likelihood flaw could dilute deToken’s value, undermining pool stability and user trust.

Vulnerability Details

The function calls deToken.mint() without a crvUSD balance check. Example:

Pool has 500 crvUSD; attacker deposits 1000 rToken (1000 crvUSD worth).
Mints 1000 deToken (1e18 rate, scalingFactor = 1e18).
Liquidations drain 500 crvUSD, leaving 500 deToken unbacked.
Attacker withdraws 500 rToken, diluting deToken value.

Impact

Unbacked deToken (e.g., 500 units) reduces pool credibility, a medium-impact issue. The medium likelihood arises from reserve depletion during liquidations, a plausible scenario that could erode economic stability.

Tools Used

Manual Code Review: To confirm oversight in deposit().

Recommendations

Add a crvUSD balance check:

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update();
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
require(crvUSDToken.balanceOf(address(this)) >= deCRVUSDAmount, "Insufficient crvUSD to back mint");
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
_mintRAACRewards();
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::getExchangeRate hardcodes 1:1 ratio instead of calculating real rate, enabling unlimited deToken minting against limited reserves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.