Part 2

Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Submission Details
Severity: high
Invalid

Variables Misassignment

## Summary
`ctx.vaultAsset` and `ctx.usdc` variables misassignment in the `else` block of `CreditDelegationBranch::settleVaultsDebt`.
## Vulnerability Details
In `CreditDelegationBranch::settleVaultsDebt`, when the vault is in credit(that is, the vault has more USDC than vault
assets) the `else` block is triggered which makes a call to `CreditDelegationBranch::calculateSwapAmount` to get the amount
of USDC needed to be swapped to vault asset.
The function `CreditDelegationBranch::calculateSwapAmount` takes the parameters:
1. `dexAdapter`: The address of the DEX adapter used for price calculation.
2. `assetIn`: The address of the USDC token to calculate the amount for. The address of the USDC to be swapped for
vaultasset.
3. `assetOut`: The address of the vault asset.
4. `vaultUnsettledDebtUsdAbs`: The unsettled debt in USD in native token precision.
However, the function call(`CreditDelegationBranch::calculateSwapAmount`) in the `else` block misarrange these parameters
using `ctx.vaultAsset` as `assetIn` instead of `ctx.vaultAsset` being the `assetOut` and using `ctx.usdc` as `assetOut`
instead of `ctx.usdc` being the `assetIn`.
```javascript
ctx.usdcIn = calculateSwapAmount(
dexSwapStrategy.dexAdapter,
ctx.vaultAsset,
ctx.usdc,
usdcCollateralConfig.convertSd59x18ToTokenAmount(ctx.vaultUnsettledRealizedDebtUsdX18.abs()),
);
```
## Impact
This calculate incorrect amount of USDC(`ctx.usdc`) to be swapped for vault assets(`ctx.vaultAsset`) which in turn swap
incorrect amount of USDC(`ctx.usdc`) for the vault assets(`ctx.vaultAsset`).
## Recommendations
Change the position of `ctx.vaultAsset` for the position of `ctx.usdc`
```diff
} else {
// get swap amount; both input and output in native precision
ctx.usdcIn = calculateSwapAmount(
dexSwapStrategy.dexAdapter,
- ctx.vaultAsset,
+ ctx.usdc,
- ctx.usdc,
+ ctx.vaultAsset,
usdcCollateralConfig.convertSd59x18ToTokenAmount(ctx.vaultUnsettledRealizedDebtUsdX18.abs())
);
```
Updates

Lead Judging Commences

inallhonesty Lead Judge
6 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.