Zaros Part 1

Summary

In current protocol, the funding fee paid/received by long/short is determined by the fill price of the order. Result of it can end up for misplayed funding fees and unfair distribution in some case.

Vulnerability Details

SettlementBranch._fillOrder:

fillPriceX18gets quotes from Chainlink Stream and uses protocol-friendly quotes. If users opens long, then use a higher ASK price. If the user opens short, then use a lower BID price. However, using fillPrice in getNextFundingFeePerUnit will cause all funding fees for this market since the last funding fee settlement to be settled at fillPrice.

As a direct result of this, the party that receives funding fee can always increase the fee it collects by making tiny orders, and the party that pays the funding fee can always decrease the fee it collects by making tiny orders as well.

More precisely, the party receiving funding fee can place a small long order (using the ASK price) to steer the funding fee to a higher level, and the party paying the funding fee can place a small short order (using the BID price) to steer the funding fee towards a lower price.

Impact

In addition to the effects described above, this calculation also has the potential to lead to incorrect liquidation - since MarkPrice used to calculate the funding rate in a liquidation is always based on the IndexPrice of the tokens and not the BID/ASK Price.

Likelihood: high + Impact: medium = Severity: High

Tools Used

Github + Manual review

Recommendations

When calculating NextFundingFeePerUnit, the markPrice used should be the index price of the market and not the fill price of the order. (Consistent with liquidation)