Core Contracts

Summary

The totalSupply function in the DebtToken contract is incorrectly computing the total supply due to improper usage of rayDiv. This causes the reported supply to be significantly lower than expected. In contrast, the balanceOf function correctly applies rayMul for individual balances. The discrepancy leads to misrepresented token supply, which can affect contract functions that rely on accurate supply calculations.

Vulnerability Details

• Issue:
  The totalSupply function applies rayDiv when adjusting the scaled total supply:

  return scaledSupply.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());

  ​

  This incorrectly reduces the supply value, making it much smaller than intended. Meanwhile, the balanceOf function correctly scales balances using rayMul. Instead of rayDiv, the total supply calculation should be based on multiplying by the normalized debt.

• Affected Code:

  function totalSupply() public view override(ERC20, IERC20) returns (uint256) {

  uint256 scaledSupply = super.totalSupply();

  return scaledSupply.rayDiv(ILendingPool(_reservePool).getNormalizedDebt()); // Incorrect logic

  }

  ​

  The incorrect scaling method distorts the total supply figure, impacting the accuracy of token-related metrics.

Impact

• Underreported Total Supply:
  The contract returns a lower total supply than the actual circulating amount, leading to misaligned calculations for liquidity, borrowing rates, and valuation.

• Potential Financial Implications:
  Functions relying on an accurate supply, such as token distribution, interest calculations, and reserves, may be affected, leading to imbalances.

• Discrepancies in Token Metrics:
  Incorrect supply representation may mislead users and external systems relying on this data, potentially causing integration issues.

Tools Used

• Manual Code Review

Recommendations

1. Fix the Total Supply Calculation:
   Update totalSupply to correctly scale the value using rayMul instead of rayDiv:

   function totalSupply() public view override(ERC20, IERC20) returns (uint256) {

   uint256 scaledSupply = super.totalSupply();

   return scaledSupply.rayMul(ILendingPool(_reservePool).getNormalizedDebt()); // Corrected logic

   }

   ​

2. Ensure Consistency in Scaling Logic:
   Align the scaling logic in both balanceOf and totalSupply to ensure uniform calculations across the contract.