Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No settlement fee is charged when USDC is the underlying asset

greese

Summary

There are two functions _convertAssetsToUsdc and _convertUsdcToAssets which handle swapping assets to and from usdc to settle credit and debt. The issue is that settlement fee is not charged when the underlying asset is USDC.

Vulnerability Details

In _convertAssetsToUsdc there is a check to see if the underlying asset is USDC. If it is, no swap is required and the usdc out remains the same. The problem is that there is not settlement fee charged in this scenario.
https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/market-making/branches/CreditDelegationBranch.sol#L815C9-L818C10

// if the asset being handled is usdc, output it to `usdcOut`
if (asset == usdc) {
assetOut = usdcAmount;
} else {
// load the market making engine configuration storage pointer
MarketMakingEngineConfiguration.Data storage marketMakingEngineConfiguration =
MarketMakingEngineConfiguration.load();
​
// cache the settlement base fee value using usdc's native decimals
uint256 settlementBaseFeeUsd = Collateral.load(usdc).convertUd60x18ToTokenAmount(
ud60x18(marketMakingEngineConfiguration.settlementBaseFeeUsdX18)
);
​
if (settlementBaseFeeUsd > 0) {
// revert if there isn't enough usdc to convert the base fee
// NOTE: keepers must be configured to buy good chunks of usdc at minimum (e.g $500)
// as the settlement base fee shouldn't be much greater than $1.
if (usdcAmount < settlementBaseFeeUsd) {
revert Errors.FailedToPaySettlementBaseFee();
}
​
// subtract fee from usdc input
usdcAmount -= settlementBaseFeeUsd;
​
// distribute the base fee to protocol fee recipients
marketMakingEngineConfiguration.distributeProtocolAssetReward(usdc, settlementBaseFeeUsd);
}

For example, it is possible that a vault uses USDC as it collateral asset (ctx.vaultAsset == ctx.usdc) . They may be incentivized to do so, as settleVaultsDebt would not charge a settlement fee

Impact

No fee on USDC

Tools Used

Manual Review

Recommendations

Fee settlement should be outside the if else blocks to ensure it is charged

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.