Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

_repay() incorrectly compares against scaled debt instead of actual debt

smacaud1

Summary

The _repay() incorrectly compares repayment amounts against userScaledDebt(scaled debt) instead of userDebt (actual accrued debt), leading to under-repayments that leave residual debt which can leads to bad loans

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L412

// Calculate the user's debt (for the onBehalfOf address)
uint256 userDebt = IDebtToken(reserve.reserveDebtTokenAddress).balanceOf(onBehalfOf);
uint256 userScaledDebt = userDebt.rayDiv(reserve.usageIndex);
​
// If amount is greater than userDebt, cap it at userDebt
uint256 actualRepayAmount = amount > userScaledDebt ? userScaledDebt : amount; //@audit: should be userDebt not userScaledDebt

  • userScaledDebt represents the debt principal without interest

  • userDebt (actual debt) = userScaledDebt * usageIndex (principal + interest)

  • Current logic caps repayments at principal amount, ignoring accrued interest

Attack Scenario:

  1. Alice borrows 100 DAI when usageIndex = 1.0

    • scaledDebt = 100 DAI

  2. Interest accrues → usageIndex = 1.1

    • actualDebt = 100 * 1.1 = 110 DAI

  3. Alice repays 105 DAI:

    • Current Logic: Caps at 100 DAI (scaled) → Leaves 5 DAI unpaid

    • Proper Logic: Should cap at 110 DAI (actual) → Full repayment

Impact

Users can't fully repay debts which can force the protocol underwater

Tools Used

Manual review

Recommendations

Compare against actual debt instead of scaled debt

uint256 actualRepayAmount = amount > userDebt ? userDebt : amount;
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

LendingPool::_repay caps actualRepayAmount at userScaledDebt instead of userDebt, preventing users from repaying full debt with interest in one transaction

That amount is not actually used.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.