Zaros Part 1

Summary

In LiquidationBranch::liquidateAccounts the openInterest and skew are updated since the liquidation has an impact on both variables. However, the newOpenInterestX18 and newSkewX18 variables are declared but never set. As a consequence, the updateOpenInterest sets the skew and openInterest of the market to 0.

This has naturally massive negative consequences for the functioning of the market, the skew is a critical component of a perpetual market and having this reset to 0 would break the entire system.

Vulnerability Details

During liquidation, in the liquidateAccounts function, the skew and openInterest are updated to account for the impact of the liquidation on the market. These variables are essential for the correct calculation of MarketPrice and FundingVelocity.

In the liquidateAccounts function, the perpMarket.updateOpenInterest function is called to update skew and openInterest. Normally these variables need to be set first, as is done in the settlementbranch here.
However, in the liquidateAccounts funtion, the variables ctx.newOpenInterestX18 and ctx.newSkewX18 are not set and keep the initial value of 0. As a consequence, the market's skew and openInterest will be updated to 0.

Impact

Settings the skew and openInterest to 0 is a criticial failure since these variables are essential for the calculation of marketprice and fundingvelocity. It essentially breaks the market and the perpetual position system.

The impact is High and the likelyhood is 100%, so this qualifies the finding as a High.

Tools Used

Manual Review.

Recommendations

As is done in settlementBranch, the skew and openinterest first need to be calculated and then updated.