Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double Scaling in `RToken::transfer` and `RToken::transferFrom`

0xnforcer

Summary

In the RToken contract, the transfer operations (transfer and transferFrom) apply an additional scaling based on _liquidityIndex/getNormalizedIncome. This scaling is duplicated because the overridden _update function also scales transferred amounts. Consequently, users unintentionally send fewer tokens than expected when the _liquidityIndex is above 1.

Vulnerability Details

  • The RToken::transfer and RToken::transferFrom functions scale amounts using _liquidityIndex or getNormalizedIncome.

  • The _update function (overridden from ERC20) scales them again.

  • This double scaling causes the actual transferred amount to be lower than intended and grows more significant as _liquidityIndex increases.

Here is the code snippet for the issue:

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome()); //audit - double scaling
return super.transfer(recipient, scaledAmount);
}
​
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex); //audit - double scaling
return super.transferFrom(sender, recipient, scaledAmount);
}

Impact

Users will transfer less value than intended, leading to potential loss of funds or unexpected behavior in the protocol as the _liquidityIndex rises.

Tools Used

Manual Review

Recommendations

Remove the scaling from transfer and transferFrom, allowing _update to handle all required scaling once.

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
return super.transfer(recipient, amount);
}
​
​
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
return super.transferFrom(sender, recipient, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.