Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`CreditDelegation::convertMarketsCreditDepositsToUsdc` reverts if market hasn't received any fees for a given asset

alexczm

Summary

Swapping assets for USDC will be blocked if one assets from assets array passed to convertMarketsCreditDepositsToUsdc is not present in creditDeposits.

Vulnerability Details

Registred keepers calls convertMarketsCreditDepositsToUsdc to swap credit assets to USDC.
First, the function tries to get the amount for assets[i], and if the asset doesn't exist or the amount is 0, the transaction reverts and no asset gets swapped for USDC.

function convertMarketsCreditDepositsToUsdc(
uint128 marketId,
address[] calldata assets,
uint128[] calldata dexSwapStrategyIds,
bytes[] calldata paths
)
external
onlyRegisteredSystemKeepers
{
...
// load the market's data storage pointer
Market.Data storage market = Market.loadExisting(marketId);
​
...
​
for (uint256 i; i < assets.length; i++) {
// revert if the market hasn't received any fees for the given asset
@> (bool exists, uint256 creditDeposits) = market.creditDeposits.tryGet(assets[i]);
@> if (!exists) revert Errors.MarketDoesNotContainTheAsset(assets[i]);
@> if (creditDeposits == 0) revert Errors.AssetAmountIsZero(assets[i]);
​
​
// cache usdc address
address usdc = MarketMakingEngineConfiguration.load().usdc;

Impact

Existing credit assets aren't swapped to USDC. The keeper must check the existing credit assets and call the swap function again with the corect list of assets.

Tools Used

Recommendations

Instead of reverting when an asset does not exist (or when the amount is 0), use continue to allow the swap of existing assets.

- if (!exists) revert Errors.MarketDoesNotContainTheAsset(assets[i]);
- if (creditDeposits == 0) revert Errors.AssetAmountIsZero(assets[i]);
​
+ if (!exists) continue;
+ if (creditDeposits == 0) continue;
Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.