Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

The `usdToken` amount received by `depositCreditForMarket` is not burned. usdToken can depeg

alexczm

Summary

Vulnerability Details

Upon closing a profitable position, traders receive usdTokenwhich can be converted for available collateral from a vault (via initiateSwap and fulfillSwap ).
Traders can use sameusdToken to pay for negative PnL and required collateral amount is deposited via depositCreditForMarket .

The problem is that while in withdrawUsdTokenFromMarket the newly minted usdToken is added to market's netUsdTokenIssuance, in depositCreditForMarket the deposited amount is subtracted from netUsdTokenIssuance but the amount is never burned.

function depositCreditForMarket(
uint128 marketId,
address collateralAddr,
uint256 amount
)
external
onlyRegisteredEngine(marketId)
{
...
address usdToken = MarketMakingEngineConfiguration.load().usdTokenOfEngine[msg.sender];
...
// note: storage updates must occur using zaros internal precision
if (collateralAddr == usdToken) {
// if the deposited collateral is USD Token, it reduces the market's realized debt
// @audit decrease the net usd issuance but the received tokens are not burned
market.updateNetUsdTokenIssuance(unary(amountX18.intoSD59x18()));
} else {

The usdToken balance of market-making will increase more and more over time.

Impact

The usdToken's totalSupply() will ever increase and in the end the token will depeg.

Tools Used

Recommendations

In CreditDelegationBranch::depositCreditForMarket burn the received usdToken . This way the usdToken balance of the market-making address is kept in sync with the market's netUsdTokenIssuance.

Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

alexczm Submitter
6 months ago
inallhonesty Lead Judge
6 months ago
inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.