Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Mint Amount in DebtToken

olugbenga

Summary

The mint function of DebtToken incorrectly mints amountToMint (amount + balanceIncrease) when it should only mint amount. This allows a user to get more debt tokens than intended if they have an existing debt token balance.

Vulnerability Details

function mint(
...
) external override onlyReservePool returns (bool, uint256, uint256) {
....
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
uint256 amountToMint = amount + balanceIncrease;
// incorrectly mints amountToMint
_mint(onBehalfOf, amountToMint.toUint128());
​
....
}

The mintfunction mints an inflated amount to the user, which allows a user to own more debt tokens than they should. The correct mint amount should be amountsince _updatecontains the logic to scale the mint amount.

function _update(address from, address to, uint256 amount) internal virtual override {
if (from != address(0) && to != address(0)) {
revert TransfersNotAllowed(); // Only allow minting and burning
}
​
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
super._update(from, to, scaledAmount);
emit Transfer(from, to, amount);
}

Impact

  • Users receive more debt tokens than they should when borrowing from the protocol

  • Protocol's total supply of debt tokens becomes inflated

Tools Used

Manual

Recommendations

Fix the mint function to only mint the original amount:

// Update mint value
_mint(onBehalfOf, amount.toUint128());
​
// Update return values
return (scaledBalance == 0, amount, totalSupply());
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!