Zaros Part 1

Summary

The liquidateAccounts function in the LiquidationBranch contract incorrectly reports the amount of liquidated collateral by including the liquidation fee in the calculation. This leads to an overstatement of the liquidated collateral amount in liquidation events.

Vulnerability Details

Take a look at https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/LiquidationBranch.sol#L150-L161

The deductAccountMargin function returns the total amount deducted from the account, which includes both the required maintenance margin and the liquidation fee. However, this total amount is directly assigned to ctx.liquidatedCollateralUsdX18, which should only represent the actual collateral liquidated to cover the maintenance margin.

Impact

This bug results in an overstatement of the liquidated collateral amount in liquidation events. The reported liquidated collateral includes the liquidation fee, which is not actually part of the liquidated collateral but an additional charge. This can lead to:

1. Inaccurate financial reporting and accounting of liquidation events.

2. Potential misunderstanding by users or external systems relying on this data.

3. Inconsistencies in protocol analytics and risk assessments.

The severity is medium, as it doesn't directly lead to fund loss but significantly impacts the accuracy of protocol data.

Tools Used

Manual review

Recommendations

To fix this issue, separate the liquidation fee from the actual liquidated collateral amount:

Additionally, consider adding a separate variable to track the liquidation fee for transparency:

Update the LogLiquidateAccount event to include both the liquidated collateral and the actual liquidation fee:

These changes will ensure accurate reporting of liquidated collateral and provide clear separation between the liquidated amount and the liquidation fee.