Zaros Part 1

Summary

In the current implementation a user can choose his sizeDelta and he can deposit as much collateral in his account as he wants and in order to have his position in liquidatable state he needs to lose all his collateral in the account. This means you can create a position with really small margin compared to your collateral in your account which means at some point this position will be on profit and you can just close it and farm USDz

Vulnerability Details

This is how we check if someone's position is in liquidatable state now:

And the marginBalanceUsdX18 is calculated in this function

As we can see we are collecting all of the collateral that we previously deposited in our account.

Let's review how a malicious user can create a position where he will always be on profit and just farm the USDz

Attacker deposits 10000$ as collateral and he opens a position with 100$

This means that in order for his position to be liquidated he needs to lose all of the 10000$

So your positions would need to be on 9900% loss to go from 100$ to a loss of 10,000$

The attacker will just trade in market like ETH/USD for example which means that he can just hold this position until his pnl goes positive and just close it. It is close to impossible for such a position to suddenly go to -9900%.

Impact

High because a malicious user can just use this strategy to farm USDz

Tools Used

Manual review

Recommendations

When checking if a user's position is liquidatable you should check if only his margin can cover the loss, not all of his collateral in the account. If a user has lost like 98% of his margin he should be then liquidated.