Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

M-2 Users Can Mint DebtToken Repeatedly at a Lower Cost in `DebtToken::mint` Without Paying for Interest Accumulation on the Balance

0x996

Description

In DebtToken::mint, if the user is not minting DebtTokens for the first time, the condition if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) will be triggered to calculate the balance increase caused by interest accumulation. balanceIncrease will no longer be equal to 0.

However, since the condition is not strictly enforced, users can manipulate the index value and choose a lower index that makes the condition fail, thus avoiding the calculation of balanceIncrease.

Note:

  1. The RToken::mint function has a similar issue!

    1. Suggested fix: if (_userState[onBehalfOf].index == index) revert InvalidAmount();

  2. The DebtToken::burn function also has a similar issue!

    1. Suggested fix: if (_userState[from].index == index) revert InvalidAmount();

Impact

Interest Evasion: Users can selectively pass in a lower index value to make the condition fail and avoid paying the balanceIncrease caused by interest accumulation. This allows users to repeatedly mint debt tokens at a lower cost.

Recommendations

Ensure that the index passed into the mint function is reasonable and cannot be lower than the previous index!

function mint(
address user,
address onBehalfOf,
uint256 amount,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256) {
if (user == address(0) || onBehalfOf == address(0)) revert InvalidAddress();
if (amount == 0) {
return (false, 0, totalSupply());
}
+ if (_userState[onBehalfOf].index = index) revert InvalidAmount();
uint256 amountScaled = amount.rayDiv(index);
if (amountScaled == 0) revert InvalidAmount();
​
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
uint256 amountToMint = amount + balanceIncrease;
​
_mint(onBehalfOf, amountToMint.toUint128());
​
emit Transfer(address(0), onBehalfOf, amountToMint);
emit Mint(user, onBehalfOf, amountToMint, balanceIncrease, index);
​
return (scaledBalance == 0, amountToMint, totalSupply());
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!