Zaros Part 1

Summary

fillOffchainOrders() doesn't check for maxPositionsPerAccount, the user can adds an arbitrary number of markets

Vulnerability Details

in createMarketOrder()
we will check maxPositionsPerAccount by tradingAccount.validatePositionsLimit()
but in fillOffchainOrders() we don't check it

see codes:

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/SettlementBranch.sol#L186-L316

So the user can fillOffchainOrders() add as many markets as they want, breaking the maxPositionsPerAccount security restriction

Impact

Breaks the maxPositionsPerAccount security limit.
like OOG security protection

Tools Used

Recommendations

fillOffchainOrders() also needs to check maxPositionsPerAccount.