Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The first trader in a market will have a wrong inflated fundingRate

spearmint

Summary

The first trader in a market will have a wrong inflated fundingRate

Vulnerability Details

When filling an order fundingRate is calculated using perpMarket.getCurrentFundingRate(), taking a look inside it

function getCurrentFundingRate(Data storage self) internal view returns (SD59x18) {
return sd59x18(self.lastFundingRate).add(
getCurrentFundingVelocity(self).mul(getProportionalElapsedSinceLastFunding(self).intoSD59x18())
);

The fundingRate clearly depends on what getProportionalElapsedSinceLastFunding returns, taking a look inside it

function getProportionalElapsedSinceLastFunding(Data storage self) internal view returns (UD60x18) {
return ud60x18Convert(block.timestamp - self.lastFundingTime).div(
ud60x18Convert(Constants.PROPORTIONAL_FUNDING_PERIOD)
);

For the first order being filled self.lastFundingTime = 0, therefore getProportionalElapsedSinceLastFunding will return a very large positive value, therefore

fundingFeePerUnit is a value proportional to the fundingRate

Impact

The first trader in a market will have a wrong inflated fundingRate

will have wrong calculations anything to do with funding rate

Tools Used

Manual Review

Recommendations

initialize lastFundingTime in PerpMarket.sol to a reasonable value when the contract is deployed

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`self.lastFundingTime` is unitialized leading to a wrong fundingRate for the first order

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.