Core Contracts

Summary

The RToken::calculateDustAmount() function incorrectly uses RToken::totalSupply() (which is not-scaled) instead of the scaled total supply when calculating dust amounts. This leads to a significant overestimation of dust tokens, potentially allowing unauthorized withdrawal of user funds.

Vulnerability Details

The RToken contract maintains two different representations of token amounts:

1. Scaled amounts - used internally for storage and calculations

2. Normalized amounts - used externally and scaled by the current interest rate

The RToken::calculateDustAmount() function attempts to compare the contract's actual balance with its obligations to token holders:

The issue is that RToken::totalSupply() already returns a normalized value (scaled by the current interest rate):

When RToken::calculateDustAmount() multiplies this by getNormalizedIncome() again, it effectively applies the interest rate scaling twice, causing totalRealBalance to be much larger than it should be.

Impact

The double scaling of total supply in dust calculations has severe implications:

1. The totalRealBalance is artificially inflated by applying the interest rate twice

2. This causes the dust amount calculation (contractBalance - totalRealBalance) to be much smaller than it should be

3. In extreme cases, it could even prevent legitimate dust from being detected at all

4. Since dust can be withdrawn by authorized roles, this could prevent the protocol from recovering actual dust amounts

5. More critically, if contractBalance is large enough, the function could return a non-zero value even when there is no actual dust, allowing unauthorized withdrawal of user funds

The likelihood is HIGH because the issue will occur every time dust calculations are performed, as it's a fundamental error in the scaling logic.
The impact is HIGH because tt directly affects the protocol's ability to manage user funds correctly and increases as the interest rate grows over time, making the double scaling effect more severe.

Tools Used

Manual review

Recommendations

Update the RToken::calculateDustAmount() function to use the unscaled total supply:

This ensures that the interest rate scaling is only applied once, leading to accurate dust calculations.