Summary

Issue found in the previous audit - Zaros 1, is not fixed

Vulnerability Details

The issue lies in the getAccountMarginRequirementUsdAndUnrealizedPnlUsd function incorrectly using the current order's fill price as the mark price for calculating margin requirements. This causes discrepancies between the calculated margin requirements at the time of trade and during liquidation, resulting in either rejecting valid trades or allowing invalid trades, depending on the trader's position size.

Impact

The _fillOrder function may:

1. Reject valid orders where the trader has enough margin, because it uses a larger-than-actual margin requirement.

2. Accept invalid orders where the trader's margin is insufficient, because it uses a smaller-than-actual margin requirement.

3. Consider accounts liquidatable when they aren't, preventing traders from reducing their positions.

4. Allow liquidatable accounts to make trades, including closing positions when they shouldn't be able to.

Link to the report: report