Zaros Part 1

Summary

Liquidations within LiquidationBranch.sol are conducted by the liquidation chainlink autonomous keeper in batch. If there are not enough accounts waiting to be liquidated, then the keeper will withhold liquidation. Users can see they will be liquidation soon, and can choose to deposit collateral. This will in turn make them no longer liquidatable.

Vulnerability Details

Within LiquidationKeeper.sol, there is a check on the number of liquidatable accounts. Due to this, some liquidations will remain in buffer under performData. This data is public on the blockchain and can be monitored.

The market order keeper within MarketOrderKeeper.sol has no such check and thus will fill orders more frequently than liquidations. This will effectively notify users ahead of time that their positions are subject to liquidation. To delay liquidation, they may simply deposit more collateral.

Impact

Depending on how widespread the use of this exploit is, it could potentially result in an ecosystem wherein liquidations are unreliably filled, enabling users to be very risky with their positions free from reprisal. This will also diminish the expected return of assets from liquidizations on users on behalf of the protocol.

Proof of Concept

Within LiquidiationBranch.sol, we check to see that the requiredMaintenanceMarginUsdX18 is less than ctx.marginBalanceUsdX18.

The maintenance margin is calculated within TradingBranch.sol:

Clearly, requiredMaintenanceMarginUsdX18 will evaluate to the sum of all positionMaintenanceMarginUsdX18 values, or the total maintenance margin across all positions. To check if an account is liquidatable, the below must evaluate to true under TradingAccount.sol::isLiquidatable

Therefore, to avoid liquidation on subsequent calls to checkUpkeep, all a user would have to do is to deposit collateral into their account using tradingAccount.sol::depositMargin untill the above will evaluate to False. Furthermore, users may now exit any existing losing positions to diminish future liquidation chance.

Tools Used

Manual Review

Recommended Mitigation Steps

When accounts are considered liquidatable, we should handle liquidations as they come as opposed to batch processing. This will eliminate the possibility of liquidation monitoring