Zaros Part 1

Summary

The depositMargin function allows anyone (not just the account owner) to deposit collateral for other traders.

Vulnerability Details

This opens up the potential for malicious front-running activity where an attacker observes a trader's intended action (e.g., open a large position), then deposits into the trader's account in advance with the aim to financially benefit when the trader's action naturally moves the market in favor of the attacker's deposit.

Additionally, the createTradingAccount function could potentially be abused. In its current state, anyone can create an account using someone else's referral code. This could lead to confusion, potential reputational harm to the looks of the initial code owner, and even flooding a legitimate user's referral list with spam accounts.

Example

Impact

Lost of funds for users

Tools Used

Manual Review

Recommendations

Consider introducing access controls and restrictions to functions like depositMargin and createTradingAccount to prevent arbitrary accounts from submitting deposits and referrals on behalf of other users.

Validate that the account wanting to deposit tokens matches the tradingAccountId owner.

Similarly, consider only allowing the creation of a referral if the account holder decides to create one.