Zaros Part 1

Summary

During liquidation it forgets to calculate new values of openInterest and skew. As a result it sets 0 values.

Vulnerability Details

Here it sets values which are never initialized:
https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/LiquidationBranch.sol#L209

Impact

Liquidation resets openInterest and skew of markets with which liquidated account is associated. It completely messes up the core mechanic of protocol. At least it has following consequences:

1. OpenInterest and skew limits don't work. That's security mechanic to save LP's from big losses, described here: https://discord.com/channels/1127263608246636635/1260120972636327977/1265346773862584483

2. Positions can't be closed. That's because openInterest is reduced and therefore underflow: because previously it was reset to 0.

3. MarkPrice is incorrectly calculated because of resetted skew.

4. Funding velocity is incorrectly calculated and hence fundingRate is incorrect. That's because skew was resetted.

5. Order fees are incorrectly applied. That's because of skew reset.

Tools Used

Manual Review

Recommendations

Calculate values for ctx.newOpenInterestX18 and ctx.newSkewX18 in advance before setting them to storage.