Description

The code deposits the asset using the following function:

currentAmount = IAggregateToken(nRWA).deposit(borrowAmount, address(this), address(this)); 

function deposit(uint256 assets, address receiver, address controller) public override returns (uint256 shares) {
    if (receiver != msg.sender) {
        revert InvalidReceiver();
    }
    if (controller != msg.sender) {
        revert InvalidController();
    }

    shares =
        ITeller(address(this)).deposit(
            IERC20(asset()),
            assets,
!            assets.mulDivDown(minimumMintPercentage, 10_000));

    return shares;
}

The highlighted value is the minimum number of shares the contract may receive after depositing the PUSD assets without reverting.

Impact

Note that the minimumMintPercentage may prevent the Looping contract from operating normally if the ratio of assets to shares is unexpectedly high.

Recommendations

Directly call the deposit(address,uint256,uint256) function to override the value.

Remediation

This issue has been acknowledged by Solera, and a fix was implemented in commit cb00bd79↗.