Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No updates to vaults’ delegated credit to align with new thresholds in function configureMarket

kwakudr

Summary

Changing thresholds doesn’t trigger recalculation of connected vaults' credit capacity.

Vaults use outdated deleverage parameters, leading to incorrect risk assessments and under/over-liquidations.

Vulnerability Details

function configureMarket(
address engine,
uint128 marketId,
uint128 autoDeleverageStartThreshold,
uint128 autoDeleverageEndThreshold,
uint128 autoDeleverageExponentZ
)
external
onlyOwner
{
// revert if engine is set to zero
if (engine == address(0)) revert Errors.ZeroInput("engine");
​
​
// revert if marketId is set to zero
if (marketId == 0) revert Errors.ZeroInput("marketId");
​
​
// revert if autoDeleverageStartThreshold is set to zero
if (autoDeleverageStartThreshold == 0) revert Errors.ZeroInput("autoDeleverageStartThreshold");
​
​
// revert if autoDeleverageEndThreshold is set to zero
if (autoDeleverageEndThreshold == 0) revert Errors.ZeroInput("autoDeleverageEndThreshold");
​
​
// revert if autoDeleverageExpoentZ is set to zero
if (autoDeleverageExponentZ == 0) revert Errors.ZeroInput("autoDeleverageExponentZ");
​
​
// load market data from storage
Market.Data storage market = Market.load(marketId);
​
​
// update market data
market.engine = engine;
market.id = marketId;
market.autoDeleverageStartThreshold = autoDeleverageStartThreshold;
market.autoDeleverageEndThreshold = autoDeleverageEndThreshold;
market.autoDeleverageExponentZ = autoDeleverageExponentZ;
​
​
// emit event LogConfigureMarket
emit LogConfigureMarket(
engine, marketId, autoDeleverageStartThreshold, autoDeleverageEndThreshold, autoDeleverageExponentZ
);
}

The configureMarket function dictate when and how aggressively a market deleverages (reduces risk by closing positions) based on its debt-to-collateral ratio. Changes to these thresholds directly affect a market’s credit capacity (how much collateral can back liabilities).

Vaults connected to the market delegate collateral to the market to increase its credit capacity. When thresholds change, the market’s credit capacity may shift, invalidating vaults’ existing delegated credit calculations.

Vaults still reference old thresholds, calculating credit capacity incorrectly.

If thresholds are tightened (deleverage starts sooner) but capacity isn’t updated, vaults will over-delegate (exposing protocol to insolvency).

If thresholds are loosened, vaults underutilize collateral (inefficient capital allocation).

Impact

vaults will over-delegate and underutilize collateral in different market conditions

Tools Used

Manual Review

Recommendations

  • Updates vaults’ delegated credit to align with new thresholds.

// Recalculate credit for connected vaults
uint256[] memory connectedVaults = market.getConnectedVaults();
Vault.recalculateVaultsCreditCapacity(connectedVaults);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.