Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Underflow Risk in `Market::updateTotalDelegatedCredit` Function

0x23r0

Summary

The updateTotalDelegatedCredit function in the Market library is vulnerable to an underflow error when updating the total delegated credit. If a negative creditDeltaUsdX18 (e.g., during a vault withdrawal) causes the total delegated credit to become negative, the conversion to UD60x18 will revert, freezing all credit updates. This can permanently brick the protocol's credit delegation and withdrawal functionality.

Vulnerability Details

The issue isin the updateTotalDelegatedCredit function:

function updateTotalDelegatedCredit(Data storage self, SD59x18 creditDeltaUsdX18) internal {
self.totalDelegatedCreditUsd = ud60x18(self.totalDelegatedCreditUsd).intoSD59x18().add(creditDeltaUsdX18).intoUD60x18().intoUint128();
}

Issue Breakdown:

  1. Underflow Condition:
    The function adds creditDeltaUsdX18 (which can be negative) to the current totalDelegatedCreditUsd. If the result is negative, the conversion to UD60x18 will revert due to the underflow check in the intoUD60x18 function:

function intoUD60x18(SD59x18 x) pure returns (UD60x18 result) {
int256 xInt = SD59x18.unwrap(x);
if (xInt < 0) {
revert CastingErrors.PRBMath_SD59x18_IntoUD60x18_Underflow(x); // <-- Reverts on negative values
}
result = UD60x18.wrap(uint256(xInt));
}

  1. Example Scenario:

    • totalDelegatedCreditUsd = 100

    • creditDeltaUsdX18 = -150

    • The calculation attempts to compute: 100 + (-150) = -50

    • The conversion to UD60x18 reverts because -50 is negative.

Impact

All credit delegation and withdrawal functions will revert if the total delegated credit becomes negative, effectively bricking the protocol.

Tools Used

Manual review

Recommendations

To fix the issue, add a check to ensure that the total delegated credit does not become negative after applying the creditDeltaUsdX18. If the result would be negative, revert with a descriptive error message.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Vault::_updateCreditDelegations uses unsigned UD60x18 for credit delegation delta calculation which will underflow on any decrease in credit delegation amount

Appeal created

0x23r0 Submitter
10 months ago
inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Vault::_updateCreditDelegations uses unsigned UD60x18 for credit delegation delta calculation which will underflow on any decrease in credit delegation amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!