Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Scaling Operation in Debt Token Total Supply Calculation

olugbenga

Summary

The debt token's totalSupply function incorrectly uses rayDiv instead of rayMul when scaling the supply with the normalized debt index. This results in an incorrect and lower total debt than exists in the system.

Vulnerability Details

Debt token balances are stored in scaled form (divided by index). To get actual debt, scaled amounts should be multiplied by the current index. However, current implementation divides instead, reducing the debt amount.

function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledSupply = super.totalSupply();
return scaledSupply.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
}

Example scenario:

Values:

  • Scaled supply = 1000

  • Normalized debt index = 1.1

Current calculation (incorrect):````totalSupply = 1000 / 1.1 ≈ 909````[Returns less debt than actually exists]

Should be:````totalSupply = 1000 * 1.1 = 1100````[Correct debt amount]

Impact

  • reports incorrect total debt

  • Protocol parameters based on total debt would be miscalculated

Tools Used

Manual

Recommendations

Fix the scaling operation:

function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledSupply = super.totalSupply();
return scaledSupply.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::totalSupply incorrectly uses rayDiv instead of rayMul, severely under-reporting total debt and causing lending protocol accounting errors

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::totalSupply incorrectly uses rayDiv instead of rayMul, severely under-reporting total debt and causing lending protocol accounting errors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.