Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Positive PnL should be minted to the account when being liquidated

SBSecurity

Summary

Positions with a positive PnL will lose their PnL on liquidation.

Vulnerability Details

When a position is liquidated, it covers the requiredMaintenanceMarginUsdX18 and the liquidationFee from the marginBalance of the trading account. In the event that a position has a positive PnL but can still be liquidated, the user will lose their positive PnL (USDz) as there is no explicit case when the PnL is positive.

On liquidation, it will check if requiredMaintenanceMarginUsdX18 > marginBalanceUsdX18 (margin + PnL + funding) and if so, it will deduct requiredMaintenanceMarginUsdX18 from margin only, so PnL will be forgotten and cleared with the position at the end.

LiquidationBranch.sol
​
135: TradingAccount.Data storage tradingAccount = TradingAccount.loadExisting(ctx.tradingAccountId);
136:
137: // get account's required maintenance margin & unrealized PNL
138: (, UD60x18 requiredMaintenanceMarginUsdX18, SD59x18 accountTotalUnrealizedPnlUsdX18) =
139: tradingAccount.getAccountMarginRequirementUsdAndUnrealizedPnlUsd(0, SD59x18_ZERO);
140:
141: // get then save margin balance into working data
142: ctx.marginBalanceUsdX18 = tradingAccount.getMarginBalanceUsd(accountTotalUnrealizedPnlUsdX18);
143:
144: // if account is not liquidatable, skip to next account
145: // account is liquidatable if requiredMaintenanceMarginUsdX18 > ctx.marginBalanceUsdX18
146: if (!TradingAccount.isLiquidatable(requiredMaintenanceMarginUsdX18, ctx.marginBalanceUsdX18)) {
147: continue;
148: }
149:
150: // deduct maintenance margin from the account's collateral
151: // settlementFee = liquidationFee
152: ctx.liquidatedCollateralUsdX18 = tradingAccount.deductAccountMargin({
153: feeRecipients: FeeRecipients.Data({
154: marginCollateralRecipient: globalConfiguration.marginCollateralRecipient,
155: orderFeeRecipient: address(0),
156: settlementFeeRecipient: globalConfiguration.liquidationFeeRecipient
157: }),
158: pnlUsdX18: requiredMaintenanceMarginUsdX18,
159: orderFeeUsdX18: UD60x18_ZERO,
160: settlementFeeUsdX18: ctx.liquidationFeeUsdX18
161: });

Impact

User will not receive their positive PnL on liquidation.

Tools Used

Manual Review

Recommendations

Add a check to mint the positive PnL as in SettlementBranch._fillOrder.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

slavcheww Submitter
about 1 year ago
inallhonesty Lead Judge
12 months ago
inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inside Liquidation process, before deducting margin, verify if there is a positive PnL, if so, deposit that amount of PnL into the TradingAccount, and mint USDZ

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.