Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`PerpMarketBranch.getOpenInterest()` incorrectly calculates `shortsOpenInterest`

T1MOH

Vulnerability Details

Natspec describes what values it should return:
https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/PerpMarketBranch.sol#L50-L52

/// @notice Returns the given market's open interest, including the size of longs and shorts.
/// @dev E.g: There is 500 ETH in long positions and 450 ETH in short positions, this function
/// should return UD60x18 longsOpenInterest = 500e18 and UD60x18 shortsOpenInterest = 450e18;

However it calculates shortsOpenInterest incorrectly. Let's take values from example - follow calculated values in comments:

function getOpenInterest(uint128 marketId)
external
view
returns (UD60x18 longsOpenInterest, UD60x18 shortsOpenInterest, UD60x18 totalOpenInterest)
{
PerpMarket.Data storage perpMarket = PerpMarket.load(marketId);
​
// halfSkew = 50 / 2 = 25e18
SD59x18 halfSkew = sd59x18(perpMarket.skew).div(sd59x18(2e18));
​
// currentOpenInterest = 950e18 (500 Long + 450 Short)
SD59x18 currentOpenInterest = ud60x18(perpMarket.openInterest).intoSD59x18();
​
// halfOpenInterest = 950 / 2 = 475e18
SD59x18 halfOpenInterest = currentOpenInterest.div(sd59x18(2e18));
​
// longsOpenInterest = 475e18 + 25e18 = 500e18
longsOpenInterest = halfOpenInterest.add(halfSkew).lt(SD59x18_ZERO)
? UD60x18_ZERO
: halfOpenInterest.add(halfSkew).intoUD60x18();
​
// shortsOpenInterest = -475e18 + 25e18 = -450e18
//@audit However it's uint => hence revert
shortsOpenInterest = unary(halfOpenInterest).add(halfSkew).abs().intoUD60x18();
totalOpenInterest = longsOpenInterest.add(shortsOpenInterest);
}

Impact

PerpMarketBranch.getOpenInterest() reverts on underflow.

Tools Used

Manual Review

Recommendations

- shortsOpenInterest = unary(halfOpenInterest).add(halfSkew).abs().intoUD60x18();
+ shortsOpenInterest = halfOpenInterest.add(unary(halfSkew)).abs().intoUD60x18();
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.