Core Contracts

Summary

The calculateDustAmount function exhibits inconsistent scaling methodology when comparing contract balances - using rayDiv for downscaling contract balance while applying rayMul for upscaling total real balance. This scaling inconsistency could result in inaccurate dust calculations.

Vulnerability Details

• Contract Balance Calculation:

  uint256 contractBalance = IERC20(_assetAddress).balanceOf(address(this)).rayDiv(ILendingPool(_reservePool).getNormalizedIncome());

  The balance is scaled down using normalized income.

• Total Real Balance Calculation:

  uint256 totalRealBalance = currentTotalSupply.rayMul(ILendingPool(_reservePool).getNormalizedIncome());

  The total supply is scaled up using the same factor.

• Issue:
  Opposing scaling directions create a mismatch between the compared values, potentially distorting the dust amount calculation.

Impact

• Dust Calculation Errors: May produce inaccurate surplus token calculations

• Financial Reporting Issues: Could affect token donation and rebalancing decisions

• Transparency Concerns: Misrepresented surplus balances may impact stakeholder confidence

Tools Used

• Manual code review

Recommendations

Standardize Scaling Operations:

• Implement consistent scaling methodology for both balance calculations to ensure accurate comparisons