Core Contracts

Summary

In the RToken::calculateDustAmount function, the totalSupply is incorrectly multiplied twice by getNormalizedIncome(). This occurs because the totalSupply function already scales the supply by getNormalizedIncome(), and then calculateDustAmount multiplies it again. This double multiplication leads to incorrect calculations of the dust amount.

Vulnerability Details

The issue arises due to the following sequence of operations:

1. The totalSupply function returns the scaled total supply by multiplying the raw supply by getNormalizedIncome().

2. In calculateDustAmount, the currentTotalSupply is fetched, which is already scaled by getNormalizedIncome().

3. The totalRealBalance is then calculated by multiplying currentTotalSupply by getNormalizedIncome() again, resulting in an incorrect value.

This double multiplication causes the totalRealBalance to be significantly larger than intended, leading to incorrect dust amount calculations.

Impact

This will always lead to a situation where no dust amount can be withdraw.

Tools Used

Manual review

Recommendations

To fix this issue, remove the redundant multiplication by getNormalizedIncome() in the calculateDustAmount function. The totalSupply function already scales the supply correctly, so no additional scaling is needed.

Update the calculateDustAmount function as follows:

This change ensures that the totalRealBalance is calculated correctly, avoiding the double multiplication issue and providing accurate dust amount calculations.