Zaros Part 1

Lines of code

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/GlobalConfigurationBranch.sol#L243-L267

Impact

If configureMarginCollateral is called and the loanToValue ratio of a collateral is set 0, the collateral is not removed from the collateralLiquidationPriority. In this case the collateral which should not contribute to the accounts marginBalance will still be used to pay fees and settling losses of an account, resulting in the protocol receiving unwanted collateral. Depending on the reason for setting the loanToValue value of a collateral to 0 this can lead to significant financial loss for the protocol.

Proof of Concept

The collateralLiquidationPriority is a list of collateral types ordered by priority. When a trading account is liquidated or closes a position with a loss, the protocol will first use the collateral types that are higher in the priority list to pay the fees and losses of the account. Only after those have been exhausted will it liquidate the collateral types lower in the priority list. This is because the higher priority collateral types typically have a higher Loan-To-Value (LTV) ratio, meaning they are considered more stable and less risky.

The LTV ratio is also used to calculate the marginBalance in USD of an account which in turn determines how much exposure an account can have towards open positions.

If for some reason a collateral becomes unstable because, e.g. a stable coin loses his peg, and its LTV ratio is set to 0 to ensure it does no longer contribute to the accounts marginBalance, the collateral will still be used for paying fees and losses when an account is liquidated or closes a position with a loss. This means that the undesirable collateral is send to the protocol which can lead to further significant losses down the road.

Recommended Mitigation Steps

To ensure that a collateral which LTV ratio is set to 0 is not continued to be used for paying fees and losses when an account is liquidated or closes a position, remove the collateral from the collateralLiquidationPriority when setting its LTV to 0: