Zaros Part 1

Summary

When an order is settled, the price used to update funding can change depending on whether the order is a "buy" or a "sell." This difference causes an inaccuracy in how much funding is accrued, leading to some users paying too much in funding fees.

Vulnerability Details

The core problem with this implementation is that the new funding fee will be based on different prices depending on whether the order is a buy or sell. When there is a large spread between the bid and ask prices, the difference in funding fees can be relatively large.

As seen in the code, the indexPriceX18 differs depending on if the order is a buy order:

That indexPriceX18 is then used to determine the fillPriceX18. Different index prices will result in different fill prices:

Finally, the fillPriceX18 is used to determine the fundingFeePerUnitX18:

The issue arises here: if the fill price is high because of the order type, the fundingFeePerUnitX18 will be inaccurately high. Conversely, if the fillPriceX18 is low, the funding fee will be inaccurately low.

This issue is unpredictable since it depends on whether the first order will be a buy or a sell. Moreover, all subsequent orders within the same transaction will not impact the funding since getProportionalElapsedSinceLastFunding will be zero.

It is important to use the current price when updating funding, but the bid/ask is not the real price and by using it funding will be unpredictable in its updates.

The likelihood of this happening is high, as it will occur with every order. The impact is medium because, although it results in a real loss of funds due to incorrect funding accounting, the amount is relatively small depending on the bid/ask spread. This makes it an overall high-severity issue.

Impact

Loss of funds due to inaccurate accounting of funding fees.

Tools Used

Manual analysis

Recommendations

Use the fill price throughout the function except when updating funding fees. For updating funding fees, use the index price instead of the bid or ask price.