Core Contracts

Summary

The DebtToken contract computes a scaled amount using the usage index during the burn operation but does not utilize this computed value when burning tokens. This oversight can lead to discrepancies in the reduction of the user’s debt, as the actual burned tokens may not reflect the intended scaled amount.

Vulnerability Details

Within the burn function, the contract similarly computes a scaled value:

This calculation is meant to adjust the burn amount to the current usage index, thereby reflecting the true underlying debt reduction after considering accrued interest. However, the function burns tokens based solely on the unscaled amount provided by the caller, disregarding the computed amountScaled. Consequently, the debt reduction may not accurately match the intended amount once scaling is taken into account.

Impact

• Inaccurate Debt Reduction:
  The failure to use the scaled amount for burning tokens may cause the debt reduction to be miscalculated, leading to inconsistencies in the user’s recorded debt.

• Potential Accounting Errors:
  As the burned tokens do not properly account for accrued interest, there may be discrepancies in the protocol’s internal debt tracking and any external systems relying on these metrics.

• User Trust Issues:
  Inconsistent behavior in how debt is repaid or reduced may confuse users, undermining confidence in the protocol's debt management mechanism.

Tools Used

• Manual code review

Recommended Mitigation

Adjust the burn function so that the number of tokens burned corresponds to the computed amountScaled. This change will ensure that the debt reduction accurately reflects the scaling imposed by the usage index.