Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Inconsistent price adjustment in vault credit capacity calculation

cipher27

Summary

The vault credit capacity calculation uses unadjusted collateral price while the debt calculation uses adjusted price, leading to incorrect capacity values.

Vulnerability Details

In getVaultCreditCapacity(), the function uses unadjusted assetPriceX18 to convert debt to asset amount, while the debt value itself is calculated using adjusted price:

File: VaultRouterBranch.sol
81: // get collateral asset price
82: UD60x18 assetPriceX18 = vault.collateral.getPrice();
83:
84: // convert the vault debt value in USD to the equivalent amount of assets to be credited or debited
85: SD59x18 vaultDebtInAssetsX18 = vaultDebtUsdX18.div(assetPriceX18.intoSD59x18());

The debt value vaultDebtUsdX18 comes from a chain of function calls:

  1. getTotalDebt() calls getUnsettledRealizedDebt.

  2. getUnsettledRealizedDebt() uses marketsRealizedDebtUsd which is updated in _recalculateConnectedMarketsState().

  3. The debt value originates from Market's getCreditDepositsValueUsd() which uses adjusted price.

File: Market.sol
215: function getCreditDepositsValueUsd(Data storage self) internal view returns (UD60x18 creditDepositsValueUsdX18) {
216: // load the map of credit deposits and cache length
217: EnumerableMap.AddressToUintMap storage creditDeposits = self.creditDeposits;
218: uint256 creditDepositsLength = creditDeposits.length();
219:
220: for (uint256 i; i < creditDepositsLength; i++) {
221: // load each credit deposit data & associated collateral
222: (address asset, uint256 value) = creditDeposits.at(i);
223: Collateral.Data storage collateral = Collateral.load(asset);
224:
225: // update the total credit deposits value
226: creditDepositsValueUsdX18 =
227: creditDepositsValueUsdX18.add((collateral.getAdjustedPrice().mul(ud60x18(value))));
228: }
229: }

Impact

The inconsistent price usage leads to incorrect vault credit capacity calculation which affects token swap rates during redemptions.

Recommendations

Use adjusted collateral price instead of unadjusted price when calculating vault credit capacity.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`VaultRouterBranch::getVaultCreditCapacity` should use the adjusted collateral price

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.