Zaros Part 1

Summary

It's impossible for users to open maximum allowed positions per account because of the wrong check in validatePositionsLimit():

activePositionsLength >= maxPositionsPerAccount

Vulnerability Details

One function of validatePositionsLimit() is to ensure an account doesn't open more than the maximum allowed positions. Hence this check:

if (activePositionsLength >= maxPositionsPerAccount) {
revert Errors.MaxPositionsPerAccountReached(self.id, activePositionsLength, maxPositionsPerAccount);
}

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/TradingAccount.sol#L98C6-L100C10

However, the use of "=" in the check means an account cannot open the allowed maximum positions. For example:

If an account is allowed 9 positions max, with the present check in the validatePositionsLimit(), an account cannot open 9 positions except 8. Whereas, 9 is the maximum allowed positions an account can open.

Impact

An account will not be able to open the allowed maximum position because of the wrong check in validatePositionsLimit().

Tools Used

Manual review

Recommendations

The check should be written this way:

if (activePositionsLength > maxPositionsPerAccount) {
revert Errors.MaxPositionsPerAccountReached(self.id, activePositionsLength, maxPositionsPerAccount);
}