Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Return Value of `newTotalSupply` in the `DebtToken.mint()` Function

kupiasec

Summary

The DebtToken.mint() function currently returns totalSupply() as its last return value. Instead, it should return scaledTotalSupply().

Vulnerability Details

The last return value of the DebtToken.mint() function is totalSupply(), which is incorrect. It should return scaledTotalSupply() instead.

function mint(
...
​
167 return (scaledBalance == 0, amountToMint, totalSupply());
}
​
--------------------
​
function totalSupply() public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledSupply = super.totalSupply();
@> return scaledSupply.rayDiv(ILendingPool(_reservePool).getNormalizedDebt());
}

In the LendingPool.borrow() function, newTotalSupply is assigned the last return value of the DebtToken.mint() function and is used to update reserve.totalUsage. Since reserve.totalUsage indicates the total amount borrowers should repay in the units of the underlying reserve token, newTotalSupply must reflect this value. However, since DebtToken.mint() returns totalSupply(), which is not in the units of the underlying reserve token, the reserve state of the LendingPool is updated incorrectly, leading to erroneous behaviors within the protocol.

function borrow(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
...
​
@> (bool isFirstMint, uint256 amountMinted, uint256 newTotalSupply) = IDebtToken(reserve.reserveDebtTokenAddress).mint(msg.sender, msg.sender, amount, reserve.usageIndex);
​
...
​
// reserve.totalUsage += amount;
@> reserve.totalUsage = newTotalSupply;
​
// Update liquidity and interest rates
ReserveLibrary.updateInterestRatesAndLiquidity(reserve, rateData, 0, amount);
​
// Rebalance liquidity after borrowing
_rebalanceLiquidity();
​
emit Borrow(msg.sender, amount);
}

Impact

The reserve state of the LendingPool is updated incorrectly, resulting in adverse effects on the entire protocol.

Tools Used

Manual review

Recommendations

Return scaledTotalSupply() instead of totalSupply() to ensure accurate updates.

function mint(
...
​
- return (scaledBalance == 0, amountToMint, totalSupply());
+ return (scaledBalance == 0, amountToMint, scaledTotalSupply());
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint returns totalSupply() instead of scaledTotalSupply(), causing incorrect updates to reserve.totalUsage in LendingPool.borrow()

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint returns totalSupply() instead of scaledTotalSupply(), causing incorrect updates to reserve.totalUsage in LendingPool.borrow()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!