Core Contracts

Summary

calculateDustAmount is used to calculate the dust amount in the contract. However, the logic used for the computation is wrong.

Vulnerability Details

The calculateDustAmount() function contains two scaling errors:

1. The contract's actual token balance is incorrectly scaled down:

   uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this))

   .rayDiv(ILendingPool(_reservePool).getNormalizedIncome());

This operation wrongly divides the actual token balance by the normalized income, when the balance represents the real amount and should not be scaled.

2) The total supply is scaled twice:

Since currentTotalSupply is obtained from totalSupply(), which already includes scaling by normalized income, which results in double-scaling the value.

Impact

Since it is scaling up the totalSupply and scaling down contractBalance, this incorrect logic will lead to the owner withdrawing an amount that is not dust as dust which will affect user withdrawals and borrowing

Tools Used

Manual

Recommendations

Implement the correct logic