Core Contracts

Vulnerability Details

On RToken::transfer() a wrong amount will always be transferred. As the amount argument is applied twice a rayDiv() with the liquidity index.

When transfering the first div happens here.

And the second happens in _update(), here.

This is because transfer calls eventually call update. See OZ ERC20 implementation here.

Impact

RToken::transfer() results always in the receiver receiving less amount.

Recommendations

Only apply the rayDiv() once, remove the division here. The _update() div one will now be the only one.

For reference you can see AAVE aToken::ScaledBalanceToken code, they only apply it once, here. Right before the common ERC20 logic call.