Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`totalRealBalance` Miscalculation in the `RToken.calculateDustAmount()` Function

kupiasec

Summary

The totalRealBalance should represent the amount of underlying assets corresponding to the total supply of RToken. However, it is incorrectly multiplied by the liquidity index twice, leading to an inaccurate calculation of the excess amount and resulting in locked underlying assets.

Vulnerability Details

The RToken.calculateDustAmount() function miscalculates the totalRealBalance.

The totalRealBalance is computed by multiplying the liquidity index by the currentTotalSupply. However, since the currentTotalSupply has already been adjusted by the liquidity index (as seen in the totalSupply() function), it is unnecessary and incorrect to multiply it by the liquidity index again.

As a result, the calculated excess amount is lower than it should be, causing some underlying assets to be locked.

function calculateDustAmount() public view returns (uint256) {
// Calculate the actual balance of the underlying asset held by this contract
uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this)).rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
​
// Calculate the total real obligations to the token holders
uint256 currentTotalSupply = totalSupply();
​
// Calculate the total real balance equivalent to the total supply
325 uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
// All balance, that is not tied to rToken are dust (can be donated or is the rest of exponential vs linear)
return contractBalance <= totalRealBalance ? 0 : contractBalance - totalRealBalance;
}

Impact

Some underlying assets may be locked.

Tools Used

Manual review

Recommendations

Do not multiply by the liquidity index.

function calculateDustAmount() public view returns (uint256) {
// Calculate the actual balance of the underlying asset held by this contract
uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this)).rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this));
​
// Calculate the total real obligations to the token holders
uint256 currentTotalSupply = totalSupply();
​
// Calculate the total real balance equivalent to the total supply
- uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
+ uint256 totalRealBalance = currentTotalSupply;
// All balance, that is not tied to rToken are dust (can be donated or is the rest of exponential vs linear)
return contractBalance <= totalRealBalance ? 0 : contractBalance - totalRealBalance;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::calculateDustAmount incorrectly applies liquidity index, severely under-reporting dust amounts and permanently trapping crvUSD in contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!