Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Protocol assumes that the price of usdToken is equal to 1

Oblivionis

Summary

Protocol assumes that the price of usdToken is equal to 1, Making users suffer huge losses when usdToken depeg.

Vulnerability Details

In function _fillOrder(), globalConfiguration.usdToken is used as settlement token:

// cache settlement token
ctx.usdToken = globalConfiguration.usdToken;

When users have an unsettled PnL > 0, The contract will mint a quantity = unsettled PnL in usd value of usdToken directly to their margin account; but when users has an unsettled PnL < 0, the contract will deduct the corresponding usd of collateral from their margin account based on chainlink feed.

if (ctx.pnlUsdX18.gt(SD59x18_ZERO)) {
ctx.marginToAddX18 = ctx.pnlUsdX18.intoUD60x18();
tradingAccount.deposit(ctx.usdToken, ctx.marginToAddX18);
​
// mint settlement tokens credited to trader; tokens are minted to
// address(this) since they have been credited to trader's deposited collateral
LimitedMintingERC20(ctx.usdToken).mint(address(this), ctx.marginToAddX18.intoUint256());
}
​
// pay order/settlement fees and deduct collateral
// if trader's old position had negative pnl
tradingAccount.deductAccountMargin({
feeRecipients: FeeRecipients.Data({
marginCollateralRecipient: globalConfiguration.marginCollateralRecipient,
orderFeeRecipient: globalConfiguration.orderFeeRecipient,
settlementFeeRecipient: globalConfiguration.settlementFeeRecipient
}),
pnlUsdX18: ctx.pnlUsdX18.lt(SD59x18_ZERO) ? ctx.pnlUsdX18.abs().intoUD60x18() : UD60x18_ZERO,
orderFeeUsdX18: ctx.orderFeeUsdX18,
settlementFeeUsdX18: ctx.settlementFeeUsdX18
});

In the event of usdToken depeg, the entire protocol will be in a death spiral - Once a user incurs a loss, the loss will be calculated in dollar value. But if the user generates a gain, then the gain will be calculated in discounted usdToken. This will eventually lead to a massive wave of liquidations and protocol at risk of insolvency.

Impact

Likelihood: low - stablecoin depeg is rare.

+

Impact: Critical - May lead to a massive wave of liquidations and protocol at risk of insolvency.

=

Severity: medium

Tools Used

Manual review

Recommendations

if trader's old position had positive pnl, protocol should mint tokens of corresponding value to the user.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Protocol assumes that the price of USDz is equal to 1

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.