Zaros Part 1

Summary

A position which is decreasing in size is afforded several benefits such as lower margin requirement. However, the codebase fails to consider a position which is decreasing but yet increasing in the opposite direction, providing a loophole to increase positions with lower margin requirements.

Vulnerability Detail

A position is considered "decreasing" if:

1. self.size > 0 && sizeDelta < 0, which indicates a decreasing long position

2. self.size < 0 && sizeDelta > 0, which indicates a decreasing short position
   But it fails to consider:

3. self.size > 0 && sizeDelta < 0 but abs(sizeDelta) > self.size which indicates both a decreasing long AND an increasing short

4. self.size < 0 && sizeDelta > 0 but abs(sizeDelta) > self.size which indicates both a decreasing short AND an increasing long

For example, creating a 1 ETH long position, then creating another -5 ETH short position is considered "decreasing" when it should be "increasing" in the short direction.

This loophole also allows traders to increase the size of their position even if market or settlement is disabled, since it relies on the isIncreasing function as well, see https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/SettlementBranch.sol#L376

Impact

Increasing a position indicates taking on more risk so the system requires the trader to meet initial margin. However, for the conditions shown above, a trader is increasing a position but is only required to meet maintenance margin. This introduces additional risk to the whole market and could cause bad debt if the maintenance margin is insufficient to cover losses during liquidations.

Traders can also increase positions even while market or settlement is disabled which can have serious consequences.

Code Snippet

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/Position.sol#L171

Tool used

Manual Review

Recommendation

The following cases should be considered as increasing a position:

• self.size > 0 && sizeDelta < 0 but abs(sizeDelta) > self.size

• self.size < 0 && sizeDelta > 0 but abs(sizeDelta) > self.size