Core Contracts

Summary

The RToken.calculateDustAmount() function fails to consider the assets deposited into the curveVault. As a result, the calculated excess amount is lower than it should be (often resulting in a value of 0), which leads to the actual excess amount being locked.

Vulnerability Details

The RToken.calculateDustAmount() function does not take into account the assets deposited into the curveVault.

During the minting and burning of RToken (specifically during the deposit() and withdraw() processes of the LendingPool), the rebalancing process deposits some underlying assets into the curveVault. These amounts are still for RToken holders.

When calculating the excess amount of underlying assets (defined as the difference between the actual balance of underlying assets and the corresponding underlying amount for the total supply of RToken, adjusted for the exchange rate index), it is essential to account for the assets deposited into the curveVault.

However, the current implementation does not reflect this, resulting in the excess amount being underestimated and causing some (or nearly all) of the actual excess amount to be locked.

Impact

Some underlying assets may be locked.

Tools Used

Manual review

Recommendations

Account for the deposited amount into the curveVault.