Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`recalculateVaultsCreditCapacity` will revert when vault has lower creditCapacity than the previous one

ChainDefenders

Summary

During the recalculateVaultsCreditCapacity in one of the underlying function _updateCreditDelegations, this function will iterate through all of the markets for the current vault. If the previousCreditDelegationUsdX18 was higher than the current one, logic will revert.

Vulnerability Details

Let's have the following situation:

  1. We have 1 Market and this market has only vault, also the vault is connected just to this one.

  2. Let's have for the previousCreditDelegationUsdX18 = 80 and for the current newCreditDelegationUsdX18 = 70, because for example user withdrawn some of the funds or there is the drop of the price of the asset.

  3. The above values will revert due to 70 - 80 = -10, but the value holders are using UD60x18, which is the unassigned value.

Impact

The current implementation of the _updateCreditDelegations function can lead to unexpected reverts when the newCreditDelegationUsdX18 is less than the previousCreditDelegationUsdX18. This occurs because the function uses UD60x18 (unsigned decimal) for calculations, which cannot handle negative values. This will make the vault and respectively the market unusable, until the newCreditDelegationUsdX18 is less than the previousCreditDelegationUsdX18.

Tools Used

Manual review

Recommendations

Consider changing the logic to use SD59x18:

SD60x18 newCreditDelegationUsdX18 = vaultCreditCapacityUsdX18.gt(SD59x18_ZERO)
- ? vaultCreditCapacityUsdX18.intoUD60x18().mul(creditDelegationShareX18)
+ ? vaultCreditCapacityUsdX18.intoSD59x18().mul(creditDelegationShareX18)
: SD59x18_ZERO;
​
// calculate the delta applied to the market's total delegated credit
- UD60x18 creditDeltaUsdX18 = newCreditDelegationUsdX18.sub(previousCreditDelegationUsdX18);
+ SD60x18 creditDeltaUsdX18 = newCreditDelegationUsdX18.sub(previousCreditDelegationUsdX18);
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Vault::_updateCreditDelegations uses unsigned UD60x18 for credit delegation delta calculation which will underflow on any decrease in credit delegation amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.