Core Contracts

Summary

DebtToken.mint() and DebtToken.burn calculations are wrong. We dont need to add balanceIncrease since it is considered inside balanceOf().
balanceOf returns the current debt of the user and we just need to mint new tokens for the current amount.

Vulnerability Details

Consider:

• User borrows 100 tokens when index = 2. So user has 100/2=50 debt tokens.

  • super.balanceOf (user) = 50

  • userIndex = 2

• Now after some time, index = 4 and user debt would be 200 (It is doubled since index is doubled)

• user wants to borrow 1 wei amount. Since borrow is near zero, user debt should remain same as 200

  • amount = 1 wei (just for simplicity of test - you can test with any number)

• User calls Borrow(1) and it calls mint(1).

  function mint(

  address user,

  address onBehalfOf,

  uint256 amount,

  uint256 index

  ) external override onlyReservePool returns (bool, uint256, uint256) {

  --snip--

  uint256 scaledBalance = balanceOf(onBehalfOf);

  ​

  uint256 balanceIncrease = 0;

  if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {

  balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);

  }

  ​

  _userState[onBehalfOf].index = index.toUint128();

  ​

  uint256 amountToMint = amount + balanceIncrease;

  ​

  _mint(onBehalfOf, amountToMint.toUint128());

  }

mint function calculations is like this:

• scaledBalance = balanceOf(onBehalfOf) = super.balanceOf(account) * Index = 50*4 = 200

• balanceIncrease = scaledBalance * (Index - userIndex) = 200*(4-2) = 400

• amountToMint = amount + balanceIncrease = 1+400 = 401

• _mint(onBehalfOf, 401)

  • user balance will increase by 401/4= 100.25

We can see that it mints a lot of debt tokens for user and increase totalDebt (totlaUsage) while the borrow amount was near 0.

100 new tokens will be minted for user and his debt will be 100*4=400. which is double of the correct amount

Impact

Users may mint or burn more tokens than intended, allowing them to exploit this bug to gain excess funds or incur unintended losses.

Tools Used

vscode

Recommendations

remove balanceIncrease in DebtToken.mint