Summary

The contract contains a vulnerability in the getAdjustedProfitForMarketId() function, where the profit for a position is incorrectly inflated if the Auto Deleverage (ADL) Factor exceeds 1. This could occur when the market enters an ADL state, and the ADL factor is used to adjust the profit. If the ADL factor returns a value greater than 1 (as seen in some conditions), the profit will be inflated instead of properly adjusted downward, potentially leading to significant financial losses or unexpected system behavior.

Vulnerability Details

The vulnerability arises from the fact that the ADL factor (adlFactor) is not properly restricted to values less than or equal to 1. If the ADL factor exceeds 1, the profit will be incorrectly inflated instead of reduced, leading to discrepancies in profit reporting and potential financial instability.

Steps to Reproduce:

1. Deploy a contract that interacts with the affected market's functions, specifically getAdjustedProfitForMarketId().

2. Assume a market condition where:

   • delegatedCreditUsd = 1000000 * 1e18 (1 million USD worth of credit).

   • totalDebt = 800000 * 1e18 (800k USD worth of debt).

3. A user has an open position with a profit of 1000 * 1e18 USD (1000 USD profit).

4. The getAutoDeleverageFactor() function returns a value greater than 1, for example 1500 (equivalent to 1.5).

5. The profit adjustment is made as follows:

   solidity

   CopyEdit

   adjustedProfitUsdX18 = 1500 * 1000 * 1e18 = 1.5 million USD

   As a result, the profit is inflated from 1000 USD to 1.5 million USD, which is incorrect.

Impact

Financial Losses and Market Instability:

• The inflation of profits could lead to significant discrepancies between reported and actual profits, potentially causing misallocations of funds and creating an unstable environment for market participants.

• Incorrect Profit Reporting:

  • Traders or users interacting with the market may be misled into thinking they have more profit than they actually do, which could lead to incorrect liquidations, trades, or further systemic issues.

• Mismanagement of Delegated Credit:

  • Inflated profits could lead to incorrect adjustments in the market's credit capacity, affecting further transactions and inflating the system's debt/credit ratios.

• Reputation Damage:

  • Exploiting this bug could severely damage the reputation of the platform, as users may lose trust in the system's ability to properly calculate their profits and debts.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, the ADL factor should be capped to ensure it cannot exceed 1 (i.e., no profit should ever be inflated). The following modification should be made to the code: