Submission Details
Severity:
before transferring R token update state should be called in lending pool
Summary
before transferring R token update state should be called in lending pool
Vulnerability Details
Following is from the R token contract
function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}
So in order to correctly transfer the tokens getnormalized income should return the latest value for that we need to call the update state function on the lending pool contract which updates the liquidity index upto date.
Impact
Incorrect scaled amount
Tools Used
Recommendations
Call update state function before calculating the scaled amount.
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
LendingPool::getNormalizedIncome() and getNormalizedDebt() returns stale data without updating state first, causing RToken calculations to use outdated values
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.