Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`settleVaultsDebt` will actually worsen the debt of a vault

novaman33

Summary

The root cause of this issue is that debt is accounted negatively. However in order to settle the debt of a vault the function will swap collateral for USDC and further decrease the marketsRealizedDebtUsd resulting in increasing the debt instead of settling it.

Vulnerability Details

In the settle vault debt for a vault to be in debt the following condition is required:

// if the vault is in debt, swap its assets to USDC
if (ctx.vaultUnsettledRealizedDebtUsdX18.lt(SD59x18_ZERO)) {

Here the vaultUnsettledRealizedDebtUsdX18 is the result of the following function:

function getUnsettledRealizedDebt(Data storage self)
internal
view
returns (SD59x18 unsettledRealizedDebtUsdX18)
{
unsettledRealizedDebtUsdX18 =
sd59x18(self.marketsRealizedDebtUsd).add(unary(ud60x18(self.depositedUsdc).intoSD59x18()));
}

After the collateral is swapped the following storage update is made:

​
// use the amount of usdc bought with assets to update the vault's state
// note: storage updates must be done using zaros internal precision
//
// deduct the amount of usdc swapped for assets from the vault's unsettled debt
vault.marketsRealizedDebtUsd -= ctx.usdcOutX18.intoUint256().toInt256().toInt128();

As a result the getUnsettledRealizedDebt will now return an even more negative value. This is incorrect as debt should be decreased. In order for it to be decreased the marketsRealizedDebtUsd should be increased.

Impact

The settleVaultsDebt will actually put the vault in more debt

Tools Used

Manual Review

Recommendations

vault.marketsRealizedDebtUsd += ctx.usdcOutX18.intoUint256().toInt256().toInt128();
Updates

Lead Judging Commences

inallhonesty Lead Judge
5 months ago
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.