Part 2

Summary

In the _updateCreditDelegations function, an underflow vulnerability exists when calculating the creditDeltaUsdX18 value. This occurs when the newCreditDelegationUsdX18 is less than the previousCreditDelegationUsdX18, resulting in a negative value. Since creditDeltaUsdX18 is of type UD60x18 (unsigned), this triggers an underflow, causing the transaction to revert. This issue can lead to a denial-of-service (DoS) scenario, preventing the vault from updating credit delegations and disrupting the system's liquidity management.

Vulnerability Details

The vulnerability is in the _updateCreditDelegations function:

https://github.com/Cyfrin/2025-01-zaros-part-2/blob/main/src/market-making/leaves/Vault.sol#L1C1-L617

Here, newCreditDelegationUsdX18 and previousCreditDelegationUsdX18 are both of type UD60x18, which represents unsigned decimal numbers. If newCreditDelegationUsdX18 is less than previousCreditDelegationUsdX18, the subtraction will result in a negative value. However, since UD60x18 cannot represent negative numbers, this operation will underflow, causing the transaction to revert.

Example Scenario:

1. Previous delegation: 100 USD (stored as UD60x18).

2. New delegation: 80 USD (due to reduced capacity).

3. Calculation: creditDeltaUsdX18 = 80 - 100 = -20.

4. Result: Underflow occurs, and the transaction reverts.

Impact

Vaults cannot update credit delegations when their credit capacity decreases, freezing debt distributions and liquidity management.

Tools Used

Manual review.

Recommendations

To mitigate this issue, implement a check to ensure that newCreditDelegationUsdX18 is greater than or equal to previousCreditDelegationUsdX18 before performing the subtraction. If newCreditDelegationUsdX18 is less than previousCreditDelegationUsdX18, handle the case appropriately (e.g., by setting creditDeltaUsdX18 to zero or using a signed type for the calculation).