Zaros Part 1

Severity: High

Summary

The protocol assumes the trader has incurred loss if the account becomes liquidatable and does not reward the unrealized profits.

Vulnerability Details

LiquidationBranch::liquidateAccounts ignores the unrealized profit: LiquidationBranch.sol#L138-L161

The LiquidatorBranch::liquidateAccounts function calculates the requiredMaintenanceMarginUsdX18 and accountTotalUnrealizedPnlUsdX18 for the account and the account is considered liquidatable if the account margin balance plus the unrealized profit is less than the requiredMaintenanceMarginUsdX18.

If the account is liquidatable, the function then deducts the liquidation fee and the requiredaMintenanceMarginUsdX18 from the trader's collateral.

The function ignores the accountTotalUnrealizedPnlUsdX18 and does not account for the possibility that the trader has profits. The trader could have positive accountTotalUnrealizedPnlUsdX18 if the account became liquidatable because of the decline in the price of the collateral instead of losses from the positions.

Example Scenario:

Trader Alice has opened a Long position on BTC perp market using WETH as collateral. The BTC price has increased and Alice position has made profit. However, the price of ETH has decreased resulting in the value of Alice's collateral to be less than the required maintenance margin (even after adding the profits). Alice account became liquidatable with profits. Alice account is liquidated.

Alice lost the profits made.

Impact

Traders loses unrealized profits if their account became liquidatable because of decrease in the price of their collateral(s).

Tools Used

Manual Review

Recommendations

Add any unrealized profits to the trader's account before liquidating.