Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`ctx.usdc` and `ctx.vaultAsset` variables misassignment

eddiepumpin
## Summary
​
`ctx.usdc` and `ctx.vaultAsset` variables misassignment in `CreditDelegationBranch::settleVaultsDebt`.
​
## Vulnerability Details
​
In `CreditDelegationBranch::settleVaultsDebt`, when the vault is in debt and the condition
`if (ctx.vaultUnsettledRealizedDebtUsdX18.lt(SD59x18_ZERO))` evaluates to true this makes a call to
`CreditDelegationBranch::calculateSwapAmount` with the following `dexSwapStrategy.dexAdapter`, `ctx.usdc`, `ctx.vaultAsset`
and `usdcCollateralConfig.convertSd59x18ToTokenAmount(ctx.vaultUnsettledRealizedDebtUsdX18.abs())` to calculate the amount of
assets required to be swapped for USDC to cover for vault debt.
​
```javascript
if (ctx.vaultUnsettledRealizedDebtUsdX18.lt(SD59x18_ZERO)) {
// get swap amount; both input and output in native precision
ctx.swapAmount = calculateSwapAmount(
dexSwapStrategy.dexAdapter,
ctx.usdc,
ctx.vaultAsset,
usdcCollateralConfig.convertSd59x18ToTokenAmount(ctx.vaultUnsettledRealizedDebtUsdX18.abs())
);
```
​
However, the function made call to (`CreditDelegationBranch::calculateSwapAmount`) takes the parameters:
​
1. `dexAdapter`: The address of the DEX adapter used for price calculation.
2. `assetIn`: The address of the vault asset to calculate the amount for. The address of the assets to be swapped for USDC.
3. `assetOut`: The address of the USDC token, that is the address of the token to be received after the swapped.
4. `vaultUnsettledDebtUsdAbs`: The unsettled debt in USD in native token precision.
​
This will return an incorrect amount to be swapped(`ctx.swapAmount`) because `ctx.usdc` is used as `assetIn` instead of
`ctx.vaultAsset` as the `assetIn` and `ctx.vaultAsset` is used as `assetOut` instead of `ctx.usdc` as the `assetOut`.
## Impact
​
This swap incorrect amount of assets(`ctx.vaultAsset`) for USDC because of the returned incorrect amount(`ctx.swapAmount`) is
used as the amount of assets(`ctx.vaultAsset`) for USDC.
​
```javascript
ctx.usdcOut = _convertAssetsToUsdc(
vault.swapStrategy.usdcDexSwapStrategyId,
ctx.vaultAsset,
ctx.swapAmount,
vault.swapStrategy.usdcDexSwapPath,
address(this),
ctx.usdc
);
```
​
## Tools Used
​
Solidity
​
## Recommendations
​
Swap the position of `ctx.usdc` for the position `ctx.vaultAsset` in the `if()` block.
​
```diff
if (ctx.vaultUnsettledRealizedDebtUsdX18.lt(SD59x18_ZERO)) {
// get swap amount; both input and output in native precision
ctx.swapAmount = calculateSwapAmount(
dexSwapStrategy.dexAdapter,
- ctx.usdc,
+ ctx.vaultAsset,
- ctx.vaultAsset,
+ ctx.usdc,
usdcCollateralConfig.convertSd59x18ToTokenAmount(ctx.vaultUnsettledRealizedDebtUsdX18.abs())
);
.
.
.
}
```
Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!