Zaros Part 1

Summary

In the current Zaros protocol design, the liquidation-related logic uses quotes from the Chainlink Stream, while the execution of user orders uses quotes from the Chainlink Feed. Currently there is no logic restricting the anchoring of these two prices, which can lead to a number of potential problems.

Please note this issue does not depend on Chainlink's error - Both Chainlink Feed and Chainlink Stream are TRUSTED and behave normally.

Vulnerability Details

According to Chainlink DoC:

Price Feeds | Chainlink Documentation

Chainlink Data Feeds provide data that is aggregated from many data sources by a decentralized set of independent node operators.

Data Streams Liquidity-Weighted Bid-Ask Prices (LWBA) | Chainlink Documentation

A Liquidity-Weighted price considers the Bid and Ask prices based on the available liquidity at each price level in the order books. This method weights price data by the volume of assets available at each price point, and provides a more accurate reflection of market conditions where larger orders would significantly impact the price.

Due to differences in the underlying design, when both Feed and Stream are working properly, there is no guarantee that the price anchors of both. In fact, IndexPrice (fetched from Chainink feed) is likely to fall outside the ASK-BID price band(fetched from Chainink stream).

Here are some potential impacts:

1. IndexPrice < BID Price < ASK Price

   Users with short positions can trade at prices above the liquidation price and can reduce their position size to avoid being liquidated.

   Users who open short positions can use less initial margin (compared to their BID price)

2. BID Price < ASK Price < IndexPrice

   Users with long positions can trade at prices above the liquidation price and can reduce their position size to avoid being liquidated.

   Users who open long positions can use less initial margin (compared to their ASK price)

Impact

Likelihood: medium - Chainlink Feed will always lag behind Chainlink Stream when prices change drastically(due to the heartbeat and deviation method)

+

Impact: medium - When this happens, certain users cannot trade normally and certain users can trade accounts that should be liquidated.

=

Severity: Medium

Tools Used

Manual review

Recommendations

Acknowledge this risk, maybe add relevant depeg-prevention.