Zaros Part 1

Summary

Vulnerability allows users to place market orders and increase their position size when the market is disabled. if users place a market order in the opposite direction with a larger size, the

Position.iIncreasing() function incorrectly returns false, enabling users to increase their positions even when the market is supposed to be disabled.

Vulnerability Details

The vulnerability exists in the createMarketOrder function, particularly in the logic that determines whether a position is being increased or not. The problematic code is within the isIncreasing function. If a user places a market order in the opposite direction with a larger size, isIncreasing incorrectly returns false even tough user position size is incresed. This logic flaw allows users to bypass the checks that prevent position increases when the market is disabled.

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/Position.sol#L155

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/OrderBranch.sol#L262

Impact

Users can exploit this flaw to increase their positions even when the market is disabled, leading to unfair trading advantages.

Tools Used

Manual

Recommendations

Ensure the logic correctly identifies if absolute position size increased or not.