Summary

The getAccountLeverage function incorrectly calculates leverage when an account has a negative margin balance, leading to misleading leverage metrics.

Vulnerability Details

The getAccountLeverage function is responsible for calculating the leverage of a trading account by dividing the total notional value of the account's positions by its margin balance. The function retrieves the margin balance as a signed value (SD59x18), which can be negative if the account is undercollateralized. It then converts this signed value to an unsigned value (UD60x18) using intoUD60x18(). This conversion can lead to incorrect leverage calculations if the margin balance is negative, as the conversion from signed to unsigned types without handling negative values can result in unexpected behavior, such as reverting or producing large incorrect leverage values.

This misrepresents the account's actual risk, potentially hiding insolvency or leading to erroneous risk assessments.

Impact

I'm rating this as medium because it allows for incorrect leverage calculations, which can misrepresent the account's actual risk and potentially hide insolvency.

Tools Used

Manual Review

Recommendations

Make sure the conversion from signed to unsigned types handles negative values appropriately, possibly by enforcing a check that prevents negative margin balances from being converted or used in leverage calculations.