Submission Details
Severity:
raw amount minting in rtoken inflates the balance
Summary
The mint function in RToken.sol mints the raw amountToMint instead of the scaled amount (amountScaled), leading to over-withdrawal when the liquidity index increases. This violates the core design of interest-bearing tokens, where balances should be stored in scaled terms to properly account for interest accrual
function mint(
address caller,
address onBehalfOf,
uint256 amountToMint,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256, uint256) {
if (amountToMint == 0) {
return (false, 0, 0, 0);
}
uint256 amountScaled = amountToMint.rayDiv(index);
if (amountScaled == 0) revert InvalidAmount();
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
_userState[onBehalfOf].index = index.toUint128();
_mint(onBehalfOf, amountToMint.toUint128()); //@mints the raw amount
emit Mint(caller, onBehalfOf, amountToMint, index);
return (isFirstMint, amountToMint, totalSupply(), amountScaled);
}
Initial State:
index = 1.1 RAY (after interest accrual)
User deposits 100 underlying tokens.
Flawed Execution:
amountToMint = 100
amountScaled = 100 / 1.1 ≈ 90.909 (correct scaled amount)
Actual Mint: 100 tokens (raw amount stored)
Expected Mint: 90.909 tokens (scaled)
Index Increases Further:
New index = 1.2 RAY.
User Withdraws:
Actual Balance: 100 * 1.2 = 120
Expected Balance: 90.909 * 1.2 ≈ 109.09
Tools Used
Recommendations
the code should mint the amout/index instead of raw amount
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RToken::mint should mint the amountScaled not the amountToMint
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RToken::mint should mint the amountScaled not the amountToMint
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.