Vulnerability Details

When a partially filled short order gets filled again, the updatedAt timestamp of the associated short record is updated which resets the time required for primary liquidation even if the collateral ratio is below the liquidation threshold.

https://github.com/Cyfrin/2023-09-ditto/blob/a93b4276420a092913f43169a353a6198d3c21b9/contracts/libraries/LibShortRecord.sol#L153-L181

Although ordinary short records have one-to-one mapping with short orders, the short record at id == 254, can have multiple short orders associated with it. This can make it possible for some type of user's to keep a calculated low collateral ratio and offset the primary liquidation through the creation of short orders.
If the account is an entity that manages shorting/funds of several people, it can park the first 253 slots and make its regular short openings via id == 254 hence resetting the updatedAt frequently making primary liquidations not possible.

Cost calculation

Impact

Some users may be able to sustain a collateral ratio < primary liquidation threshold for a long time.

Recommendations

If deciding to mitigate this issue, a separate mapping could be created containing the flag times for each shortRecord.