Summary

The configureMarket function lacks comprehensive validation of related parameters, allowing for inconsistent configurations that can lead to unintended behavior in the market's auto-deleveraging mechanism.

Vulnerability Details

The configureMarket function is responsible for setting up market parameters, including thresholds for auto-deleveraging. While it ensures that none of the input values are zero, it does not verify the logical relationship between autoDeleverageStartThreshold, autoDeleverageEndThreshold, and autoDeleverageExponentZ. This omission allows the owner to set inconsistent thresholds, such as having the start threshold lower than the end threshold, which can lead to improper liquidations or locking of positions. Such misconfigurations could destabilize market operations, breaking the security guarantee of reliable and predictable market behavior.

Impact

Medium as it can lead to improper liquidations and market instability. Misconfigured thresholds can cause the auto-deleveraging mechanism to function incorrectly, resulting in financial loss and operational disruptions.

And the likelihood is Medium/Low, while the function is restricted to the contract owner, human error or lack of awareness can lead to misconfigurations. The absence of logical checks increases the risk of such errors occurring.

Tools Used

An owner could inadvertently configure the market with a start threshold higher than the end threshold, leading to a non-functional auto-deleveraging mechanism. This misconfiguration can be demonstrated by calling the configureMarket function with inconsistent parameters:

Recommendations

Add logical checks to ensure autoDeleverageStartThreshold is less than autoDeleverageEndThreshold and validate the relationship with autoDeleverageExponentZ to prevent misconfigurations.