Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

not used variable ``balanceIncrease`` in the ``mint()`` leads to mint less Rtoken to user and lost money

makriss

Summary

the balanceIncreas, is not used in RToken.sol::mint(), to calculated the accrue interest on the user's existing balance before minting new tokens.

Vulnerability Details

RToken::mint() : https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/RToken.sol#L114

uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
_mint(onBehalfOf, amountToMint.toUint128());

This function mints a new RToken for a user when they deposit crvToken asset into protocol. However, if the user already has RToken, their previous balance needs to be updated for interest before adding the newly minted amount.


Impact

this impact users second, third,.. deposit, not adding balanceIncrease, the additional value the user should receive due to interest accrual to amountToMint, cause to loss of accrued interest when a user deposits more funds.

Tools Used

Manual Review

Recommendations

amountToMint = amountToMint + balanceIncrease

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

RToken::mint calculates balanceIncrease (interest accrued since last interaction) but never mints it, causing users to lose earned interest between deposits

The balanceIncrease is the interest that has already accrued on the user's existing scaledBalance since their last interaction. It's not something you mint as new tokens in the _mint function.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

RToken::mint calculates balanceIncrease (interest accrued since last interaction) but never mints it, causing users to lose earned interest between deposits

The balanceIncrease is the interest that has already accrued on the user's existing scaledBalance since their last interaction. It's not something you mint as new tokens in the _mint function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!