Core Contracts

Summary

The DebtToken contract calculates a scaled amount using the usage index during the mint operation but does not use this value when determining the number of tokens to mint. This bypass of the intended scaling mechanism may lead to inaccurate tracking of accrued debt.

Vulnerability Details

In the mint function, the contract computes the scaled amount as follows:

This calculation is intended to convert the underlying asset amount into a scaled representation that reflects the cumulative interest (usage index). Although the function checks that amountScaled is not zero to validate the input, the minting operation itself mints tokens based on the unscaled amount plus any additional balanceIncrease derived from the difference between the previous user index and the new index. In effect, the computed amountScaled is not applied, and therefore the minted tokens might not correctly reflect the user's true debt position as influenced by the usage index.

Impact

• Inaccurate Debt Representation:
  The debt tokens minted might not correspond properly to the underlying debt accrued, leading to potential misrepresentation of a user's debt obligations.

• Accounting Discrepancies:
  External integrations or protocol components that rely on accurate scaled balances may encounter errors due to the divergence between the actual accrued interest and the minted token balances.

• User Confusion:
  Users might be misled by token balances that do not correctly reflect the scaling effects intended by the usage index, ultimately reducing trust in the protocol’s financial mechanisms.

Tools Used

• Manual code review

Recommended Mitigation

Modify the mint function so that the number of tokens minted is based on the computed amountScaled (and incorporates any necessary balance increase). This change should ensure that the minted token balance accurately reflects the underlying debt adjusted by the current usage index.