DittoETH

Summary

Combining shorts can cause problems

Vulnerability Details

The system does not permit minting the last shortRecord of a shorter (id = 254) since the last shortRecord of a shorter is reserved for special behavior. To counteract this behavior the shortRecord in position 254 is modified/blended anytime a new shortRecord would have been created with a shortRecordIdCounter greater than 254.

And the fillShortRecord function merges two shorts.

The problem is that the last short id may have been flagged.

When two shorts merge, the merge function uses the SHORT_MAX_ID and. So, the newly created short remained flagged.

Suppose the newly created short will be under minimum CR. In that case, it may get instantly liquidated, which is bad for the user because shorts are considered separated when it comes to liquidation.

Another problem is that when the two shorts merge, the merge function updates the short.updatedAt to the current time. A malicious user can open a new short to update the updateAt parameter so that his flagged short can't be liquidated.

For example :

1. Alice flags Bob's short.(id=254)(id=254)

2. Alice needs to wait for the first liquidation time to be able to liquidate Bob's short.

3. Bob sees this and creates a new short. Shorts merge and newly created short has an updated short.updatedAt.

4. Alice tries to liquidate Bob, but the transaction reverts because the time difference needs to be greater than the first liquidation time, but it's not.

Impact

1. Users may face unexpected liquidation(collateral loss).

2. Malicious users may escape primary liquidation.

Tools Used

Manual Review

Recommendations