Submission Details
Severity:
Wrong amount is getting minted during the minting of Rtokens.
Summary
Function RToken::mint, is responsible to mint RTonens , in exchange of asset tokens, but the minting of tokens is done incorrectly leading to incorrect calculation and loss fee and interest.
Vulnerability Details
In RToken::mint, the amount of asset tokens is passed to the mint function, and then the amountScaled, is calculated, which is the amount to be minted, but that amount is not minted in place of that the asset amount is minted, but the minting amount should be amountScaled.
if (amountToMint == 0) {
return (false, 0, 0, 0);
}
uint256 amountScaled = amountToMint.rayDiv(index);
if (amountScaled == 0) revert InvalidAmount();
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
_userState[onBehalfOf].index = index.toUint128();
>> _mint(onBehalfOf, amountToMint.toUint128());
Impact
Loss of interest and funds.
Tools Used
Manual Review
Recommendations
-_mint(onBehalfOf, amountToMint.toUint128());
+_mint(onBehalfOf, amountScaled .toUint128());
Updates
Lead Judging Commences
inallhonesty about 1 month ago
Submission Judgement Published Assigned finding tags:
RToken::mint should mint the amountScaled not the amountToMint
inallhonesty about 1 month ago
Submission Judgement Published Assigned finding tags:
RToken::mint should mint the amountScaled not the amountToMint
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.