Submission Details
Severity:
Accounts which are liquidatable can still trade using offchain orders
Summary
Accounts which are liquidatable can still trade using offchain orders.
Vulnerability Details
For onchain orders, OrderBranch::simulateTrade has a check:
// prevent liquidatable accounts from trading
if (TradingAccount.isLiquidatable(ctx.previousRequiredMaintenanceMarginUsdX18, marginBalanceUsdX18)) { // @audit-check marginBalance is unaltered before trade and after trade
revert Errors.AccountIsLiquidatable(tradingAccountId);
}
From the comment, we can get conclusion that accounts eligible for liquidation are prohibited from trading.
However for offchain orders, there is no such check which means accounts which are liquidatable can still trade using offchain orders.
Impact
Accounts which are liquidatable can still trade using offchain orders.
Tools Used
manual
Recommendations
Add isLiquidatable check for account in _fillOrder function like OrderBranch::simulateTrade function.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
`isLiquidatable` check missing in `_fillOrder()`
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,87821
USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.