Zaros Part 1

Summary

The protocol uses the incorrect equality sign when determining the validity of an order's fill price, leading to a loss for the trading account.

Vulnerability Details

The SettlementBranch::fillOffchainOrders incorrectly implement the logic for fill price validity checks for account orders.
For reference, the order is a buy order when the sizeDelta is greater than zero.

The code below does the opposite of desired behaviour by traders.
link

Traders Desire: For buyOrder, fill our order when the price is less than or equal to the target (entry) price because that is most favorable to us. The lower the price a buyer can enter the market, the higher the potential profit they stand to make.

Code Implementation: For buyOrder, the fill price is valid if the target price is less than or equal to the fill price, effectively limiting the upside of traders.

Proof of Concept

As shown in the ASCII diagram below, the fill price according to the protocol effectively limits the potential upside of the trader, and can theoretically execute at the take-profit price, which betrays the reasoning behind the trade and could lead to a significant loss. On the other hand, the fill price for the trader maximizes their potential return.

Impact

Execution of unfavourable trades leading to losses for traders

Tools Used

Manual

Recommendations

Flip the equality signs