Zaros Part 1

Summary

If a collateral type is removed from collateralLiquidationPriority, it cannot be deducted during liquidation, leading to liquidator receives less assets.

Vulnerability Details

A margin collateral type can be configured and added by configureMarginCollateral().

The collateral type from the liquidation priority can be removed by removeCollateralFromLiquidationPriority().

In LiquidationBranch.liquidateAccounts()#L142, the margin balance contains "effective" balance of account's all collaterals. However, the tradingAccount.deductAccountMargin() function deducts the account's margin based on globalConfiguration.collateralLiquidationPriority.

If a collateral type is removed from the liquidation priority, the collateral cannot be deducted from account, leading to the removed collateral cannot be liquidated and liquidator receives less assets.

Impact

Account's colleteral cannot be fully liquidated.

Tools Used

vscode

Recommendations

Iterate through all collateral types based on the predefined liquidation priority to deduct account's margin.