Zaros Part 1

Summary

The funding update process uses the upcoming skew to determine past accruals. This can lead to inaccuracies in funding calculations, allowing users to potentially manipulate funding fees by placing large orders that alter the upcoming skew. As a result, users will be charged more or less than they should be, leading to a loss of funds.

Vulnerability Details

The skew affects the funding fee by influencing the fill price, as demonstrated in the getMarkPrice function:

While it's appropriate to use the upcoming skew for calculating fill prices, the funding update should rely on the current skew. Using the upcoming skew can lead to users manipulating the funding fees by placing large orders, thus shifting the skew in their favor. This manipulation can cause incorrect funding fees, potentially pushing other users into liquidation.

For example:

• Bob has a position with a margin ratio of 51%, and the minimum margin for his position is 50%. Bob is near liquidation but still safe.

• Alice sees that Bob is close to liquidation and knows that when Bob’s position closes, the total open interest (OI) will decrease. Alice also understands that the skew will move in her favor as a result.

• Bob, aware that his position is close to liquidation and that the skew is in his favor, accrues positive funding fees for the last hour keeping his position safe.

• Alice places an order that shifts the skew further in Bob's direction. As a result, the skew now moves against Bob.

• This causes Bob’s positive funding to turn into negative funding, pushing his margin ratio from 51% to 49%, making him liquidatable.

Impact

Using the upcoming skew to update funding leads to stepwise (and incorrect) jumps in funding fees, resulting in loss of funds and potentially unfair liquidations.

Tools Used

Manual analysis

Recommendations

When updating funding fees, use the current skew rather than the upcoming skew. This can be achieved by separately calculating a price with a sizeDelta of 0 and using this price for updating the funding. This will ensure the update uses the current skew not the upcoming one.