Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`DebtToken.mint()` mints inflated debt tokens for user

pabloperezacc6

Summary

DebtToken.mint() mints inflated debt tokens for user, due to incorrect accounting.

Vulnerability Details

The DebtToken.mint() function mints amountToMint normalized amount of debt token to user. It is calculated as amountToMint = amount + balanceIncrease. Here, balanceIncrease is the amount of interest which user should pay and is the amount which accrues from first mint to second mint.

Let's consider following case(doesn't consider precision for convenient):

  • Alice borrows 100 assets at timestamp A. (100 debt token is minted)

  • Alice borrows 100 assets at timestamp B. (100 + interest of 100(A-B) = 100 + balanceIncrease, is minted)

  • Alice repays at timestamp C. repay amount is (100 + interest of 100(A-C)) + (100 + balanceIncrease) + interest of (100 + balanceIncrease)(B-C) = 200 + interest of 100(A-C) + interest of 100(B-C) + interest of balanceIncrease(B-C).

As result, Alice should repay more assets as interest of balanceIncrease(B-C). In other words, users should pay more assets amount of interest of balanceIncrease.

function mint(
address user,
address onBehalfOf,
uint256 amount,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256) {
if (user == address(0) || onBehalfOf == address(0)) revert InvalidAddress();
if (amount == 0) {
return (false, 0, totalSupply());
}
​
uint256 amountScaled = amount.rayDiv(index);
if (amountScaled == 0) revert InvalidAmount();
​
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
>> balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
@> uint256 amountToMint = amount + balanceIncrease;
​
@> _mint(onBehalfOf, amountToMint.toUint128());
​
emit Transfer(address(0), onBehalfOf, amountToMint);
emit Mint(user, onBehalfOf, amountToMint, balanceIncrease, index);
​
return (scaledBalance == 0, amountToMint, totalSupply());
}

Impact

Users should repay more assets than real.

Tools Used

Manual Review

Recommendations

Remove the addition of balanceIncrease to amountToMint.

function mint(
address user,
address onBehalfOf,
uint256 amount,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256) {
if (user == address(0) || onBehalfOf == address(0)) revert InvalidAddress();
if (amount == 0) {
return (false, 0, totalSupply());
}
​
uint256 amountScaled = amount.rayDiv(index);
if (amountScaled == 0) revert InvalidAmount();
​
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
>> balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
- uint256 amountToMint = amount + balanceIncrease;
+ uint256 amountToMint = amount;
​
_mint(onBehalfOf, amountToMint.toUint128());
​
emit Transfer(address(0), onBehalfOf, amountToMint);
emit Mint(user, onBehalfOf, amountToMint, balanceIncrease, index);
​
return (scaledBalance == 0, amountToMint, totalSupply());
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!