Zaros Part 1

Summary

validateMarginRequirement() validates if the given account will still meet margin requirements after a given operation. This function is intended to revert if the required margin, including fees, is greater than or equal to the account's margin balance.

However, the current implementation only reverts if the required margin is strictly greater than the margin balance.

Vulnerability Details

TradingAccount::validateMarginRequirement() function does not correctly handle the case where the required margin is exactly equal to margin balance.

As seen, the function uses the gt (greater than) operator instead of the gte (greater than or equal to) operator.

Impact

The function does not revert when the required margin is exactly equal to the margin balance, potentially allowing operations that should not be permitted. This could lead to scenarios where accounts are allowed to operate with insufficient margin, increasing the risk of liquidation and hence financial loss.

Tools Used

Manual Review

Recommendations

The condition should be changed to gte to ensure it reverts when requiredMargin is equal to or greater than marginBalance.