Zaros Part 1

Summary

The function createTradingAccount may generate non-unique account IDs if the globalConfiguration.nextAccountId is reset or not properly incremented, leading to conflicts and errors when creating new accounts.

Vulnerability Details

Description:

The function relies on globalConfiguration.nextAccountId to generate unique IDs for new trading accounts. It increments this ID with each new account creation. However, if this ID is reset or not incremented properly due to an error or manipulation, duplicate account IDs can be generated.

Root Cause:

The uniqueness of tradingAccountId depends solely on the increment operation of globalConfiguration.nextAccountId. If nextAccountId is reset to a previous value or not incremented properly, it will result in the creation of accounts with duplicate IDs.

Proof of Concept:

Consider the following scenarios:

Resetting nextAccountId:

Improper Increment:

In both cases, tradingAccountId1 and tradingAccountId2 end up being the same, causing non-unique account IDs.

Impact

• Data Integrity Issues: Duplicate account IDs can lead to overwriting existing account records or conflicts in the system.

• Functional Failures: Functions that assume unique account IDs might malfunction, causing unexpected behaviour or errors.

• Security Vulnerabilities: Malicious actors might exploit this to disrupt the system or gain unauthorized access.

Tools Used

Manual Review

Recommendations

• Ensure that nextAccountId is incremented atomically and cannot be manipulated or reset improperly.

• Implement unique constraints on account IDs at the storage layer to prevent duplication, ensuring data integrity even if an error occurs in ID generation.