DittoETH

Summary

The short can be created with values less than the minAskEth and minShortErc causing that the created order with minimum values would not be attractive to be liquidated if it is the case.

Vulnerability Details

The short order creation is possible using the ShortOrdersFacet::createLimitShort() function. It checks for minAskEth and minShortErc minimum values before everything else. The problem is that the number of bids orders can not be enough to complete the short order causing the creation of the short order with minimum values. Please consider the next scenario:

1. The new short order is executed with ercAmount: 2, price: 1, initialMargin: 500, the next validation does not rever the transaction (2 < 2 || 2 < 2 is False):

2. The new short order is matched with the unique bid order avaliable. The fillErc = 1 and fillEth = 1. The matchTotal.colUsed is 1 (incomingSellPrice) * 1 (fillErc) * 500 (initialMargin) = 500

3. Since there is only one bid order, the matching process ends and the next validation in the code line 666 is not True so the leftover incomingSell.ercAmount (1 amount) is not assigned to the orderbook (1 [left ercAmount] * 1 [incomingSellPrice] >= 2 is False).

4. The user short record creation ends with the next fills:

That is less than the required by minAskEth and minShortErc.

Impact

Shorts can be created with the less than the minimum value required by minAskEth and minShortErc causing that the short order would not be attractive to be liquidated by the liquidatiors since the collateral attached is not enough to cover the liquidation transaction.

Tools used

Manual review

Recommendations

Verify the minimum required values minAskEth and minShortErc in the short record creation LibShortRecord::createShortRecord() function.