Part 2

Description

The withdrawMarginUsd function lacks proper access control, allowing unauthorized users to potentially withdraw funds.

Summary

Unauthorized users could call the withdrawMarginUsd function, leading to loss of funds.

Vulnerability Details

• Issue: The function does not validate msg.sender to ensure only authorized users (e.g., the owner of the trading account) can perform withdrawals.

• Example: If msg.sender is not validated, any user could call the function and withdraw funds.

Impact

• Unauthorized withdrawals could result in significant financial loss.

Tools Used

• Manual Code Review

• Foundry/Forge

Recommendations

• Add an onlyOwner or custom modifier to restrict access to authorized users.

modifier onlyOwner(uint128 tradingAccountId) {

require(msg.sender == ownerOf(tradingAccountId), "Unauthorized");

_;

}