Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

The `balanceIncrease` should be calculated and minted for the user before the burning process in the `DebtToken::burn` function

pianist

Summary

Currently, the balanceIncrease variable is not accounted for, unlike in the DToken::mint function.

Vulnerability Details

The reserve.ussageIndex is updating during time, and the balanceIncrease variable represents the additional amount that should be minted for the user due to the changes in reserve.ussageIndex. However, the DebtToken::burn function does not take this into account.

Impact

Incorrect calculations.

Tools Used

Manual review.

Recommendations

add following lines in DebtToken::burn function:

function burn(
address from,
uint256 amount,
uint256 index
) external override onlyReservePool returns (uint256, uint256, uint256, uint256) {
if (from == address(0)) revert InvalidAddress();
if (amount == 0) {
return (0, totalSupply(), 0, 0);
}
+ uint256 oldUserBalance = balanceOf(from);
+ (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
+ balanceIncrease = oldUserBalance.rayMul(index) - oldUserBalance.rayMul(_userState [onBehalfOf].index);
+ }
​
+ _mint(onBehalfOf, balanceIncrease.rayDiv(index).toUint128());
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken::burn calculates balanceIncrease (interest) but never applies it, allowing borrowers to repay loans without paying accrued interest

Interest IS applied through the balanceOf() mechanism. The separate balanceIncrease calculation is redundant/wrong. Users pay full debt including interest via userBalance capping.

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

DebtToken::burn calculates balanceIncrease (interest) but never applies it, allowing borrowers to repay loans without paying accrued interest

Interest IS applied through the balanceOf() mechanism. The separate balanceIncrease calculation is redundant/wrong. Users pay full debt including interest via userBalance capping.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.