Zaros Part 1

Vulnerability Details

The Zaros protocol, as a perpetual trading platform, allows users to take long and short positions on various assets. However, unlike similar protocols such as GMX, Zaros lacks an auto-deleveraging (ADL) mechanism to protect itself from potential insolvency in extreme market conditions.

In perpetual trading platforms, when the price of the underlying asset moves significantly, it can lead to large profits for traders on one side of the market. If these profits become too large relative to the protocol's available liquidity, it may struggle to pay out all winning trades. This scenario is particularly risky for long positions during a sharp market upturn.

GMX addresses this issue with its ADL (Auto-Deleveraging) function (https://gmx-docs.io/docs/trading/v2/#synthetic-markets), which automatically starts to close out profitable long positions before the protocol becomes insolvent. This mechanism helps maintain the protocol's financial stability and ensures it can meet its obligations to all traders.

The absence of a similar feature in Zaros exposes the protocol to significant risk. In the event of a sharp market upturn, Zaros may find itself unable to pay out all winning trades, potentially leading to insolvency.

Impact

• Protocol Insolvency: In extreme market conditions, Zaros may be unable to pay out all winning trades, leading to protocol insolvency.

• Loss of User Funds: If the protocol becomes insolvent, users with winning positions may be unable to claim their profits.

Proof of Concept

1. The market experiences a sharp upturn, causing the price of an asset to increase significantly.

2. Long position holders see their positions become highly profitable.

3. The total unrealized profit of all long positions exceeds the protocol's available liquidity.

4. Without an ADL mechanism, Zaros has no automated way to reduce its exposure.

5. When traders attempt to close their profitable positions, the protocol is unable to pay out all winning trades.

6. The protocol becomes insolvent, leading to loss of user funds and trust.

Recommendations

1. Implement an Auto-Deleveraging (ADL) mechanism similar to GMX:

   • Monitor the ratio of unrealized profits to available liquidity.

   • When this ratio exceeds a predetermined threshold, automatically begin closing out the most profitable long positions.

   • Implement this in a fair and transparent manner, possibly using a queue system based on position size and profit.

2. Introduce position size limits that dynamically adjust based on the protocol's liquidity and market conditions.

3. Implement a reserve fund to provide additional liquidity during extreme market conditions.