Core Contracts

Summary

The burn function within the RToken.sol contract is responsible for burning the RToken's from a user and transferring the underlying asset in return. We calculate the user's balance via balanceOf, as well as updating the index for their independant user state in order to conclude an accurate calculation. Additionally, we scale the amount in respect of the index via RAAC's rayMul.

Vulnerability Details

The burn functionality uses the amount which is used as input for the burn function in order to send the relative amount of the _assetAddress, and also uses the incorrect amount regarding the actual _burn execution process. Prior to this, we initialise the variable amountScaled to successfully account for the scaling of amount in respect of the updated index used. However, this correct variable is not used.

Additionally, we invoke the wrong amount's when executing the return at the end of the call.

Impact

The burning functionality presents inaccurate accounting for the from user, and therefore burns the incorrect amount of tokens in respect of the index as intended.

Tools Used

Manual review

Recommendations

Utilise the correct variable which is responsible for the amount scaled, e.g. amountScaled and not directly the amount that is being passed into the function.