Zaros Part 1

Summary

The maxFundingVelocity parameter in the protocol governs the rate at which funding costs accrue on open positions. In the protocol implementation, the funding rate is dynamically calculated based on this velocity and the proportional time elapsed since the last funding update.

When maxFundingVelocity is updated via the upgradable mechanism, the new funding velocity cap is applied immediately and affects all open positions, disregarding the time already elapsed under the previous rate.

This immediate application of the new funding velocity cap leads to a sudden change in the opened leveraged positions. Users' expected funding costs could shift significantly without considering the period during which the previous rate was in effect. This behavior could have implications for risk management and position planning for traders.

Vulnerability Details

The lastFundingTime variable is updated every time a liquidation occurs or a position is opened. While this variable is frequently updated in highly active markets, it can lead to unexpected behavior in less active markets where the funding rate might not reflect the actual accrued costs over time.

This design can cause unexpected and immediate margin depletions, resulting in the liquidation of user positions in extreme cases. In an environment with high leverage, such as 100x, the impact is even more pronounced.

Proof of Concept

Initial Setup:

• A user opens a long position with 100x leverage.

• The initial funding rate is set to 0.01% per hour (0.24% per day).

• Market Movement: Over 8 hours, the asset’s price drops slightly. The user's position remains healthy, although closer to the liquidation threshold.

Protocol Upgrade:

• The protocol administrators decide to upgrade the funding rate calculation and maximum funding velocity is increased by a factor of 10.

• Post-Upgrade Effects: The funding rate immediately jumps to a higher value due to the increased maximum funding velocity. The accumulated funding fees over the past 8 hours are recalculated based on the new, higher rate.

• Unexpected Liquidation: The sudden increase in accumulated funding fees pushes the user's position below the maintenance margin threshold.

• The position becomes eligible for liquidation, even though the market price movement alone was not sufficient to trigger liquidation.

Proof of Code

Add the following code to a new file in the test suite:

Impact

The impact of this vulnerability is severe due to the following reasons:

• Immediate and unexpected increases in fees: Users with open positions will face a sudden modification in their funding fees, which can significantly affect their trading costs.

• Immediate and unexpected Financial Losses: Sudden funding rate increases can push users’ margin balance below the maintenance margin requirement, triggering immediate liquidations and financial losses for users.

• Erosion of User Trust: The unpredictability introduced by such changes can lead to a loss of trust in the platform. Users expect predictable and stable funding costs, and sudden changes can be seen as unfair or manipulative, leading to decreased user engagement and platform instability.

Tools Used

Manual testing

Recommendations

Consider introducing tracking the historical funding rates for each position. When calculating funding fees, consider the rate that was in effect during each elapsed time period, rather than applying the current rate retroactively.

This ensures that users have sufficient margin to withstand the increased funding costs.