Zaros Part 1

Summary

The function TradingAccount::isLiquidatable is not implemented as it is described under https://docs.zaros.fi/overview/products/perpetuals-dex/liquidation#liquidation-mechanics

Vulnerability Details

For a liquidation to occur, the function TradingAccount::isLiquidatable() is called, where the following condition is checked:

requiredMaintenanceMarginUsdX18.intoSD59x18().gt(marginBalanceUsdX18). In other words, if requiredMM > marginBalance, then the user can be liquidated.

The documentation states another condition for a user to be liquidated. The user can be liquidated if requiredMM + liqFee >= marginBalance.

Impact

The implemented liquidation condition is more stringent than the one decribed in the documentation. Users can be unjustly liquidated, leading to a loss of trust in the protocol.

Tools Used

Manual Review

Recommendations

Keep the condition for liquidation consistent throughout the documentation and code.