Core Contracts

Summary

The mint and burn functions are not handling scaled amounts correctly, leading to accrued interest fees being permanently locked in the pool and never claimable by lenders.

Vulnerability Details

In lending protocols, the scaled amount is calculated as:

The scaled amount is critical for proper accounting, allowing lenders to claim their share of the interest accrued in the pool.

The Issue

• During minting, instead of minting the scaled amount of RTokens, the asset amount is minted directly.

• Similarly, during burning, the asset amount is burned instead of the scaled amount.

Consequences

This incorrect handling prevents lenders from earning their rightful share of interest:

1. If a user deposits 1000 asset tokens, they receive 1000 RTokens.

2. After some time, even as interest accrues, burning those 1000 RTokens only returns 1000 asset tokens, without any interest.

This effectively results in interest loss for lenders and permanent locking of accrued interest within the pool.

Impact

• Lenders do not earn any interest, leading to a significant loss for users.

• Accrued fees remain locked in the pool.

Tools Used

Manual code review.

Recommendations

Ensure that scaled amounts are used during both minting and burning operations:

1. Minting: Mint RTokens based on the scaled amount calculated by dividing the asset amount by the liquidity index.

2. Burning: Burn the scaled amount of RTokens to return the correct share of asset tokens, including accrued interest.