Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Comparison in the `DebtToken::burn` Function

pianist

Summary

userBalance is scaled and amount is non-scaled. So we cant simply campare them and one of them needs conversion to the other.

Vulnerability Details

In the DebtToken::burn function, the amount variable represents the amount of crvUSD that the user wants to withdraw, while userBalance refers to the balance of RToken that the user possesses. These two values are not comparable because the RToken amount and the crvUSD amount do not have a 1:1 ratio.

Impact

This leads to incorrect calculations.

Tools Used

Manual review.

Recommendations

Convert userBalance to a non-scaled amount by multiplying it by the index before making the comparison.

- if(amount > userBalance){
- amount = userBalance;
- }
+ if(amount > userBalance.rayMul(index)){
+ amount = userBalance.rayMul(index);
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_repay compares scaled userScaledDebt with unscaled amount, creating unused actualRepayAmount; calculation is bypassed when burn is called with original amount

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::_repay compares scaled userScaledDebt with unscaled amount, creating unused actualRepayAmount; calculation is bypassed when burn is called with original amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.