Part 2

Summary

Vulnerability Details

Upon closing a profitable position, traders receive usdTokenwhich can be converted for available collateral from a vault (via initiateSwap and fulfillSwap ).
Traders can use sameusdToken to pay for negative PnL and required collateral amount is deposited via depositCreditForMarket .

The problem is that while in withdrawUsdTokenFromMarket the newly minted usdToken is added to market's netUsdTokenIssuance, in depositCreditForMarket the deposited amount is subtracted from netUsdTokenIssuance but the amount is never burned.

The usdToken balance of market-making will increase more and more over time.

Impact

The usdToken's totalSupply() will ever increase and in the end the token will depeg.

Tools Used

Recommendations

In CreditDelegationBranch::depositCreditForMarket burn the received usdToken . This way the usdToken balance of the market-making address is kept in sync with the market's netUsdTokenIssuance.