Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Premium/discount curve parameters are not settable in `UsdTokenSwapConfig`

cipher27

Summary

The UsdTokenSwapConfig contract lacks functionality to set premium/discount curve parameters which causes division by zero in getPremiumDiscountFactor().

Vulnerability Details

The UsdTokenSwapConfig contract has pd curve parameters in its Data struct but no way to set them.

struct Data {
uint128 baseFeeUsd;
uint128 swapSettlementFeeBps;
uint128 maxExecutionTime;
uint128 pdCurveYMin;
uint128 pdCurveYMax;
uint128 pdCurveXMin;
uint128 pdCurveXMax;
uint128 pdCurveZ;
...
}

The update() function only allows updating fees and execution time:

File: UsdTokenSwapConfig.sol
148: function update(uint128 baseFeeUsd, uint128 swapSettlementFeeBps, uint128 maxExecutionTime) internal {
149: Data storage self = load();
150:
151: self.baseFeeUsd = baseFeeUsd;
152: self.swapSettlementFeeBps = swapSettlementFeeBps;
153: self.maxExecutionTime = maxExecutionTime;
154:
155: emit LogUpdateUsdTokenSwapConfig(baseFeeUsd, swapSettlementFeeBps, maxExecutionTime);
156: }

This causes division by zero in getPremiumDiscountFactor() when calculating the premium/discount:

File: UsdTokenSwapConfig.sol
131: // calculate the y point of the premium or discount curve given the x point
132: UD60x18 pdCurveYX18 = pdCurveYMinX18.add(
133: pdCurveYMaxX18.sub(pdCurveYMinX18).mul(
134: pdCurveXX18.sub(pdCurveXMinX18).div(pdCurveXMaxX18.sub(pdCurveXMinX18)).pow(pdCurveZX18)
135: )
136: );

Impact

Users cannot initiate token swaps since the premium/discount calculation will revert due to uninitialized curve parameters.

Recommendations

Add functionality to set and update the premium/discount curve parameters in the update() function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

PremiumDiscountFactor feature cannot be properly configured / used

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.