Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect amount of RTokens minted upon deposit of reserve assets

tigerfrake

Summary

The LendingPool contract does not correctly calculate the amount of RTokens to mint to users upon deposit of reserve assets. This stems from the fact that the calculated balanceIncrease is not incremented to the user's amountToMint.

Vulnerability Details

When users invoke LendingPool.deposit(), they specify an amount of reserve assets which they will supply and get minted RTokens in exchange:

function deposit(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
// Update the reserve state before the deposit
ReserveLibrary.updateReserveState(reserve, rateData);
​
// Perform the deposit through ReserveLibrary
>> uint256 mintedAmount = ReserveLibrary.deposit(reserve, rateData, amount, msg.sender);
---SNIP---
}

In ReserveLibrary.deposit(), the mint() function from RToken is invoked to mint RToken to the depositor passing the same amount as amountToMint:

// Mint RToken to the depositor (scaling handled inside RToken)
(bool isFirstMint, uint256 amountScaled, uint256 newTotalSupply, uint256 amountUnderlying) = IRToken(reserve.reserveRTokenAddress).mint(
address(this), // caller
depositor, // onBehalfOf
>> amount, // amount
reserve.liquidityIndex // index
);

Now in RToken.mint(), the following is done:

function mint(
address caller,
address onBehalfOf,
>> uint256 amountToMint,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256, uint256) {
---SNIP---
​
uint256 scaledBalance = balanceOf(onBehalfOf);
bool isFirstMint = scaledBalance == 0;
​
uint256 balanceIncrease = 0;
// @audit-info balanceIncrease is calculated based on index delta
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
>> balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
// @audit-issue amountToMint not updated based on the balanceIncrease
>> _mint(onBehalfOf, amountToMint.toUint128());
---SNIP---
}

balanceIncrease represents the interest accrued to the user's balance between the last time their balance was updated and the current mint operation. It ensures that users receive credit for the interest that has accrued on their deposited liquidity.

However, the function calculates the balanceIncrease based on the index delta but fails to increment this to the user's amountToMint. It then simply proceeds to mint the user an incorrect amount leaving the calculated balanceIncrease unused anywhere.

Impact

This causes the amountToMint to be incorrect, potentially causing them to receive less RToken than expected.

Tools Used

Manual Review

Recommendations

The amountToMint should be updated to include the balanceIncrease:

uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
// @audit Update the amountToMint
+ amountToMint += balanceIncrease;
​
_mint(onBehalfOf, amountToMint.toUint128());
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

RToken::mint calculates balanceIncrease (interest accrued since last interaction) but never mints it, causing users to lose earned interest between deposits

The balanceIncrease is the interest that has already accrued on the user's existing scaledBalance since their last interaction. It's not something you mint as new tokens in the _mint function.

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

RToken::mint calculates balanceIncrease (interest accrued since last interaction) but never mints it, causing users to lose earned interest between deposits

The balanceIncrease is the interest that has already accrued on the user's existing scaledBalance since their last interaction. It's not something you mint as new tokens in the _mint function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.