Submission Details
Severity:
`LiquidationBranch.liquidateAccounts` should cancel off-chain orders of the liquidated account.
Summary
LiquidationBranch.liquidateAccounts should cancel all off-chain orders of the liquidated account.
Vulnerability Details
LiquidationBranch.liquidateAccounts clears a pending market order, but does not update the nonce to cancel off-chain orders.
Impact
An off-chain order may be executed after the account is liquidated if the user deposits more funds to the account.
Users should call OrderBranch.cancelAllOffchainOrders manually.
Tools Used
Manual.
Recommendations
Update as below.
// clear pending order for account being liquidated
MarketOrder.load(ctx.tradingAccountId).clear();
// @audit Update the nonce to cancel off-chain orders.
+ unchecked {
+ tradingAccount.nonce++;
+ }
https://github.com/Cyfrin/2024-07-zaros/blob/7439d79e627286ade431d4ea02805715e46ccf42/src/perpetuals/branches/LiquidationBranch.sol#L163-L164
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
`LiquidationBranch.liquidateAccounts` should cancel off-chain orders of the liquidated account.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,87821 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.