Zaros Part 1

Summary

When filling offChainOrders, all except the first order will receive a 0 funding rate. This is because getCurrentFundingRate returns 0 when getProportionalElapsedSinceLastFunding returns 0.

Vulnerability Details

fillOffchainOrders fills orders for multiple offchainOrders in the same Tx

The first order updating the funding rate will update lastFundingTime = block.timestamp

For subsequent orders, the following code snippet from _fillOrder is how the funding rate is calculated

Looking into perpMarket.getCurrentFundingRate()

Looking into getProportionalElapsedSinceLastFunding()

Since this is the subsequent order in the same tx, self.lastFundingTime == block.timestamp, therefore getProportionalElapsedSinceLastFunding will return 0, therefore getCurrentFundingRate will also return 0

This will cause the funding rate for all subsequent orders in that Tx = 0

Impact

When filling offChainOrders, all except the first order will receive a 0 funding rate.

All other calculations using funding rate will be wrong as a result, including pnl calculations

Tools Used

Manual Review

Recommendations

This requires a complete redesign of the funding fee system to make it fair