DittoETH

Ditto
DeFiFoundryOracle
55,000 USDC
View results
Submission Details
Severity: low
Valid

Event in secondaryLiquidation could be misused to show false liquidations

Summary

The liquidateSecondary function in the protocol is designed to emit events detailing the specifics of liquidation, which can be crucial for other protocols or front-end integrations that track secondary liquidations within the protocol. One of the values emitted is batches, which indicates which positions got liquidated. However the function emits the batches array as it initially receives it, even though it may skip positions that are not eligible for liquidation during its execution. This implies that the emitted event could represent incorrect data, indicating positions as liquidated even if they were not, due to their ineligibility.

function liquidateSecondary(
address asset,
MTypes.BatchMC[] memory batches,
uint88 liquidateAmount,
bool isWallet
) external onlyValidAsset(asset) isNotFrozen(asset) nonReentrant {
// Initial code
emit Events.LiquidateSecondary(asset, batches, msg.sender, isWallet);
}

Impact

This inconsistency in the emitted event data can lead to incorrect data, indicating positions as liquidated even if they were not.

Tools Used

Manual Analysis

Recommendations

Modify the batches array before emitting it in the event, ensuring it accurately reflects the positions that were actually liquidated.

Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-278

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.