Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Mint Amount in DebtToken

olugbenga

Summary

The mint function of DebtToken incorrectly mints amountToMint (amount + balanceIncrease) when it should only mint amount. This allows a user to get more debt tokens than intended if they have an existing debt token balance.

Vulnerability Details

function mint(
...
) external override onlyReservePool returns (bool, uint256, uint256) {
....
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
uint256 amountToMint = amount + balanceIncrease;
// incorrectly mints amountToMint
_mint(onBehalfOf, amountToMint.toUint128());
​
....
}

The mintfunction mints an inflated amount to the user, which allows a user to own more debt tokens than they should. The correct mint amount should be amountsince _updatecontains the logic to scale the mint amount.

function _update(address from, address to, uint256 amount) internal virtual override {
if (from != address(0) && to != address(0)) {
revert TransfersNotAllowed(); // Only allow minting and burning
}
​
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
super._update(from, to, scaledAmount);
emit Transfer(from, to, amount);
}

Impact

  • Users receive more debt tokens than they should when borrowing from the protocol

  • Protocol's total supply of debt tokens becomes inflated

Tools Used

Manual

Recommendations

Fix the mint function to only mint the original amount:

// Update mint value
_mint(onBehalfOf, amount.toUint128());
​
// Update return values
return (scaledBalance == 0, amount, totalSupply());
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.