Summary

When user transfers nft he losses earned yield, because YieldFacet._distributeYield is not called for position.

Vulnerability Details

User has ability to transfer any his position to other user. When he does that, then new position is created for other user and this position also inherits short.zethYieldRate of parent position. This variable is needed to calculate and distribute yield for position owner. This can be done in the YieldFacet._distributeYield function. Also user lose ability to receive ditto rewards for that short position. And also because new position is treated as new, then it's also not eligible to receive rewards after transfer for some time.

As result when owner of position transfers nft, he loses all yield and can't claim it anymore.

Impact

Previous owner loses yield.

Tools Used

VsCode

Recommendations

Distribute yield before transferring position