Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect transfer amount in the `RToken.transferFrom()` Function

kupiasec

Summary

The RToken.transferFrom() function calculates the transfer amount scaledAmount using _liquidityIndex, which is a state variable of the RToken contract rather than the current liquidity index of the LendingPool. As a result, this function transfers an incorrect amount.

Vulnerability Details

The RToken.transferFrom() function calculates the transfer amount scaledAmount using _liquidityIndex.

However, _liquidityIndex is a state variable of the RToken contract, so it differs from the actual liquidity index of the LendingPool.

As a result, the transfer amount is incorrect.

function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
224 uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}

Impact

The transfer amount is incorrect.

Tools Used

Manual review

Recommendations

Use the liquidity index from the LendingPool.

function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
- uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
+ uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transferFrom(sender, recipient, scaledAmount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer uses getNormalizedIncome() while transferFrom uses _liquidityIndex, creating inconsistent transfer amounts depending on function used

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer uses getNormalizedIncome() while transferFrom uses _liquidityIndex, creating inconsistent transfer amounts depending on function used

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!