Zaros Part 1

Summary

The skew of a market could go over the maxSkew due to incorrect assumption

Vulnerability Details

Every market has a skew and open interest. For example, imagine there are 3 positions, 2 longs and 1 short, all with a size of 50. The skew is a number that essentially shows whether longs or shorts overpower. In this case, skew is as the longs clearly overpower the shorts. The open interest is the total size of open positions so 150. Whenever a user opens a position, there is this function:

It essentially doesn't allow positions that would put the skew or open interest above their maximums to go through.

Whenever a liquidation occurs, we have the following line and comments above it:

From the comments, we can see that the function checkOpenInterestLimits() is not called because firstly, the open interest and skew are decreased by liquidations, thus there is no point in checking for that and also, because they don't want to cause a potential DoS in case there is somehow a way that could actually not be true. Firstly, there is another issue here which we have to assume doesn't exist and that is the fact that the arguments provided to updateOpenInterest() are both 0 due to not ctx.newOpenInterestX18 and newSkewX18 not having any values given which is a huge mistake. We have to assume it is fixed as otherwise the issue that I will explain now is not actually possible as the open interest and skew are always set to 0, thus they can not actually go above their maximums.

It says that the open interest and skew are both decreased by a liquidation. However, that is not actually true. Imagine there are 4 positions with the following sizes (minus in front means a short): 100, -150, 100, -50. Let's assume that the maximum skew is 100. From earlier, we know that the open interest for that position for these positions would be . The skew would go (for each new position) from 100, to -50, to 50, to finally 0. Now, let's imagine that the position with size of -150 gets liquidated. The open interest would decrease, as explained by the comment, and the open interest would now be 250. The skew however will go to 150 while the maximum skew in our example was 100. The skew will clearly not always decrease and even if it did decrease, a skew of -150 is still more than the maximum skew due to how a skew is supposed to be used and how it also is used in checkOpenInterestLimits() (by using absolute values, thus a skew of -150 is converted into its absolute value of 150 which is more than 100).

Impact

The skew of a market could go over the maxSkew due to incorrect assumption

Tools Used

Manual Review

Recommendations

Fix is not trivial as if you want to enforce the skews, then it would lead to reverts in some cases. If you decide not to enforce them, you have to know that the skew can in fact go over the maximum and accept the risk.