Summary

During liquidation no new OI skew calculation is performed in the LiquidationBranch:liquidateAccounts function.

Vulnerability Details

The LiquidationBranch:liquidateAccounts function is responsible for liquidating accounts. During liquidation, each position of the user being
liquidated is closed, and it updates the corresponding perpMarket's OI and OI_skew values with perpMarket.updateOpenInterest(ctx.newOpenInterestX18, ctx.newSkewX18);

However, there is no new OI skew calculation performed in the liquidation process. Effectly passing 0 as the new OI and Skew values to the perpMarket.updateOpenInterest function.

If we run the test with forge test --mt testFuzz_GivenThereAreLiquidatableAccountsInTheArray -vvvv

we can see that the Open Interest and Skew are 0 in the output

Test Output:

Notice that the exposed Position load function is returning 0 for the nonLiquidatableTradingAccountId
because in the test there is no position for the nonLiquidatableTradingAccountId in that market opened.
Thus the size of the position is 0 equal to the 0 in Open Interest, that why the test passes

Impact

By having the OI and Skew values set to 0, the system will not be able to accurately calculate the OI and Skew for the market. This could lead to lost of funds since the system will not be able to accurately calculate the funding rate and the liquidation price.

Tools Used

Manual review

Recommendations

Include the calculation of the new OI and Skew values during liquidation.
Consider adding events to log OI and Skew changes for better off-chain monitoring and auditing.