Users can break the maxPositionsPerAccount limit with offchainOrders()
Summary
fillOffchainOrders() doesn't check for maxPositionsPerAccount, the user can adds an arbitrary number of markets
Vulnerability Details
in createMarketOrder()
we will check maxPositionsPerAccount by tradingAccount.validatePositionsLimit()
but in fillOffchainOrders() we don't check it
see codes:
https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/SettlementBranch.sol#L186-L316
So the user can fillOffchainOrders() add as many markets as they want, breaking the maxPositionsPerAccount security restriction
Impact
Breaks the maxPositionsPerAccount security limit.
like OOG security protection
Tools Used
Recommendations
fillOffchainOrders() also needs to check maxPositionsPerAccount.
Lead Judging Commences
`maxPositionsPerAccount` may be exceeded by combining onchain and offchain orders
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.