DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

```MarginCallPrimaryFacet.liquidate()``` function will break in case TAPP ethEscrowed is too low

helium

Summary

while liquidating a short via MarginCallPrimaryFacet.liquidate() , _marginFeeHandler() gets called to handle margin call fees ( tappFee and callerFee ). The logic is that TAPP should always be able to handle both the fees, however there is an edge case where TAPP will not be able to handle both the fees and the function will brick. This will prevent a short from being liquidated.

Vulnerability Details

  • According to the docs:

In the rare case that the combined short collateral and TAPP balance is insufficient to cover all fees, the gasFee is waived and the tappFee is rerouted to the margin caller in its place.

  • Assuming that, a liquidator call MarginCallPrimaryFacet.liquidate() to liquidate the short.

  • TAPP.ethEscrowed should be greater or equal to callerfee for everything to go smoothly.

  • In case TAPP.ethEscrowed is less than callerFee the function will brick, because of this logic

//@dev TAPP already received the gasFee for being the forcedBid caller. tappFee nets out.
if (TAPP.ethEscrowed >= callerFee) {
TAPP.ethEscrowed -= callerFee;
VaultUser.ethEscrowed += callerFee;
} else {
// Give caller (portion of?) tappFee instead of gasFee
VaultUser.ethEscrowed += callerFee - m.gasFee + tappFee;
m.totalFee -= m.gasFee;
// @audit: this will underflow because
// m.totalFee += tappFee + callerFee;
// and if TAPP.ethEscrowed is lower than callerFee
// it's also lower than m.totalFee
// this underflow will brick the function
TAPP.ethEscrowed -= m.totalFee;
}

Impact

Short can not be liquidated because TAPP.ethEscrowed will underflow and brick the entire function

Tools Used

Manual review, VsCode

Recommendations

Maybe skip reducing TAPP.ethEscrowed -= m.totalFee; because TAPP do not have these fees to begin with, so substracting totalfee in this case is not important.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-570

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.