Submission Details
Severity:
wrong implement of "removeCollateralFromLiquidationPriority"
Summary
more than one same collateralType in collateralLiquidationPriority then our final collateralLiquidationPriority will be wrongly collected.
Vulnerability Details
if there are more than one same collateralType in collateralLiquidationPriority then our final collateralLiquidationPriority will be wrongly collected.
https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/GlobalConfiguration.sol#L163
function removeCollateralFromLiquidationPriority(Data storage self, address collateralType) internal {
// does the collateral being removed exist?
bool isInCollateralLiquidationPriority = self.collateralLiquidationPriority.contains(collateralType);
// if not, revert
if (!isInCollateralLiquidationPriority) revert Errors.MarginCollateralTypeNotInPriority(collateralType);
// the following code is required since EnumerableSet::remove
// uses the swap-and-pop technique which corrupts the order
// copy the existing collateral order
address[] memory copyCollateralLiquidationPriority = self.collateralLiquidationPriority.values();
// cache length
uint256 copyCollateralLiquidationPriorityLength = copyCollateralLiquidationPriority.length;
// create a new array to store the new order
address[] memory newCollateralLiquidationPriority = new address[](copyCollateralLiquidationPriorityLength - 1);
uint256 indexCollateral;
// iterate over the in-memory copies
for (uint256 i; i < copyCollateralLiquidationPriorityLength; i++) {
// fetch current collateral
address collateral = copyCollateralLiquidationPriority[i];
// remove current collateral from storage set
self.collateralLiquidationPriority.remove(collateral);
// if the current collateral is the one we want to remove, skip
// to the next loop iteration
if (collateral == collateralType) {
continue;
}
// otherwise add current collateral to the new in-memory
// order we are building
newCollateralLiquidationPriority[indexCollateral] = collateral;
indexCollateral++;
}
// the collateral priority in storage has been emptied and the new
// order has been built in memory, so iterate through the new order
// and add it to storage
@> for (uint256 i; i < copyCollateralLiquidationPriorityLength - 1; i++) {
self.collateralLiquidationPriority.add(newCollateralLiquidationPriority[i]);
}
}
}
}
Impact
wrong calculation of self.collateralLiquidationPriority.
Tools Used
Recommendations
for (uint256 i; i < indexCollateral; i++) {
self.collateralLiquidationPriority.add(newCollateralLiquidationPriority[i]);
}
Updates
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,87821 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.