Zaros Part 1

Relevant GitHub Links

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/LiquidationBranch.sol#L105-L223

Summary

Lack of proper locking in liquidateAccounts can lead to race conditions if multiple liquidators try to liquidate the same accounts simultaneously.

Vulnerability Details

The function liquidateAccounts does not lock the state while processing accounts, leading to potential race conditions where multiple transactions might interfere with each other, causing inconsistent state updates.

Impact

Race Conditions: Multiple liquidators might interfere with each other, causing inconsistent state updates.

Data Integrity Issues: Without proper locking, the state might become inconsistent or corrupted.

Tools Used

Manual

Recommendations

Implement Locking Mechanism: Ensure that only one liquidator can process a given account at a time to avoid race conditions.