Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`RToken::_liquidityIndex` is never updated, making `transferForm` always divide the amount by `1 WadRayMath.RAY`

farismaulana

Summary

for transferFrom function, the amount param is scaled down by dividing it with current index rate _liquidityIndexbut this value is never updated and only initialized in constructor (the value is 1 RAY or 1e27), leading to incorrect scaled amount transferred.

Vulnerability Details

RToken.sol#L223-L226

function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
@> uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}

the state _liquidityIndex can be changed by calling RToken::updateLiquidityIndexbut this function can only be called by corresponding reserve pool, and the reserve pool itself does not have any implementation to call said function.

Impact

transferFrom function would transfer invalid scaled amount, where this would later have issue when interacting with DeFI ecosystem (DEX, LP, lending-borrowing, etc)

Tools Used

manual review

Recommendations

remove the divide operation for amount, because the scaled amount would later be handled inside _updatefunction so no need to manually do this in this function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::updateLiquidityIndex() has onlyReservePool modifier but LendingPool never calls it, causing transferFrom() to use stale liquidity index values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.