Zaros Part 1

Summary

Attacker can grief depositing by sending the cap amount of collateral tokens.

Vulnerability Details

User can deposit margin only when deposit cap is not reached.

An attacker can deposit collaterals up to the depositCapX18. The result, is that no one else can deposit collaterals into the contract.

Impact

There is no deposit fee or withdrawal fee charged on deposit or withdrawal, hence a resourced attacker can perform the grief attack without taking any risk.
Users may not be able to open new positions, and before admin raise the deposit cap, their existing positions are subject to liquidation as they cannot deposit funds to keep their margin balance above maintenance margin.

Tools Used

Manual Review

Recommendations

Instead of using a total deposit cap, please consider to set individual deposit cap for each account.