Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Bypassing the `depositCap` of margin collateral

blutorque

Summary

Vulnerability Details

The depositMargin() function allow user to deposit an amount of margin collateral to their tradingAccountId. Each collateral has their own configuration such as loanToValue, priceFeed, depositCap etc. The function call checks the user deposit does not exceed the depositCap. If it does, the call reverts.

// enforce new deposit + already deposited <= deposit cap
_requireEnoughDepositCap(collateralType, amountX18, depositCapX18, totalCollateralDepositedX18);
​
function _requireEnoughDepositCap(
address collateralType,
UD60x18 amount,
UD60x18 depositCap,
UD60x18 totalCollateralDeposited
)
internal
pure
{
if (amount.add(totalCollateralDeposited).gt(depositCap)) {
revert Errors.DepositCap(collateralType, amount.intoUint256(), depositCap.intoUint256());
}
}
​

The issue here is that during the settlement of an order, the depositCap has been ignored, as can be seen in the _fillOrder() function below:

// if trader's old position had positive pnl then credit that to the trader
if (ctx.pnlUsdX18.gt(SD59x18_ZERO)) {
ctx.marginToAddX18 = ctx.pnlUsdX18.intoUD60x18();
tradingAccount.deposit(ctx.usdToken, ctx.marginToAddX18); // @audit-issue _requireEnoughDepositCap check bypassed
​
// mint settlement tokens credited to trader; tokens are minted to
// address(this) since they have been credited to trader's deposited collateral
//
// NOTE: testnet only - this call will be updated once the Market Making Engine is finalized
LimitedMintingERC20(ctx.usdToken).mint(address(this), ctx.marginToAddX18.intoUint256());
}

If a position has a positive PnL, the amount will be credited to the user's position through a tradingAccount.deposit() call without checking if the collateral depositCap has already been reached.

Impact

breaking the `depositCap`limit

Tools Used

Manual review

Recommendations

After the PnL deposit, add a _requireEnoughDepositCap() check to the _fillOrder()

Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!