Relevant GitHub Links

System variables used to track collateral information:

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/GlobalConfiguration.sol#L51

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/MarginCollateralConfiguration.sol#L26

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/TradingAccount.sol#L51

Relevant functions:

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/TradingAccount.sol#L178

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/TradingAccount.sol#L471

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/TradingAccount.sol#L342

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/GlobalConfiguration.sol#L119

Summary

When Zaros removes collateral from the liquidation list, it fails to update the valuation information of that collateral in the system, causing these remaining assets to still be considered valuable. Consequently, when evaluating user accounts, these assets participate in liquidation and new order assessments, leading to artificially inflated account values. More critically, since these assets have been removed from the liquidation list, they cannot be liquidated. Attackers can exploit this to consistently profit from their trades before closing positions, repeating this process to achieve risk-free arbitrage, ultimately draining the market maker's funds.

Vulnerability Details

Zaros uses collateralLiquidationPriorityto track collateral validity. Once collateral is removed viaremoveCollateralFromLiquidationPriority()，the system considers it worthless and users can no longerdepositMargin()it. However, the system still usesMarginCollateralConfiguration.Datato track these assets' valuations andmarginCollateralBalanceX18to record collateral assets in user accounts.Both internal removeCollateralFromLiquidationPriority() and external removeCollateralFromLiquidationPriority()functions only remove the asset from the liquidation list without updating the other two information sources.

During liquidation and order placement, the system calculates account value usinggetMarginBalanceUsd()which relies onMarginCollateralConfiguration.Data 和 marginCollateralBalanceX18. This results in these remaining assets becoming non-liquidatable with false valuations.

Attackers can exploit this non-liquidatable characteristic by leaving only these false assets in their accounts, maximizing leverage, and trading with these funds. They can achieve risk-free arbitrage by closing positions only when profitable. This exploitation can continue indefinitely unless the project team modifies the MarginCollateralConfiguration.Data for the relevant assets

POC

Using USDZ asset as an example:

1. First, let the attacker complete a trade using USDZ when the market is normal.

2. Zaros removes USDZ from the liquidation list.

3. At this point, the attacker can no longer deposit USDZ into the system.

4. However, the attacker can still use the asset as collateral to complete trades.

5. Simulate a price drop, causing the attacker's account to meet liquidation conditions (in reality, the attacker only uses 6. USDZ as collateral, so when this asset is removed from the liquidation list, the account should be considered worthless).

6. Attempt liquidation, but since USDZ has been removed from the list, it cannot be liquidated. The attacker's account valuation remains unchanged.

7. Simulate a price increase, allowing the attacker to profit, close positions, and successfully withdraw funds.

Place the following test into createMarketOrder.t.sol::CreateMarketOrder_Integration_Test:

Impact

This vulnerability artificially inflates user valuations and allows for continuous risk-free arbitrage until discovered, potentially draining market maker funds.

Typically, projects announce the removal of assets from the liquidation list and provide users time to manage their assets. Attackers could use this window to withdraw other assets and deposit large amounts of the soon-to-be-removed asset into their accounts. More aggressively, attackers could monitor project transactions and execute this strategy just before the removal is implemented.

Tools Used

Manual Review.

Recommendations

Update relevant data structures when removing collateral from the liquidation list:

• Update MarginCollateralConfiguration.Data.loanToValue to 0