Part 2

Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Submission Details
Severity: low
Valid

wrong value emitted in `LogLiquidateAccount` event

Vulnerability Details

In LiquidationBranch.sol, [LogLiquidateAccount](https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/perpetuals/branches/LiquidationBranch.sol#L30-L38) is defined as

event LogLiquidateAccount(
address indexed keeper,
uint128 indexed tradingAccountId,
uint256 amountOfOpenPositions,
uint256 requiredMaintenanceMarginUsd,
int256 marginBalanceUsd,
uint256 liquidatedCollateralUsd,
uint128 liquidationFeeUsd
);

The LogLiquidateAccount event is [emitted](https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/perpetuals/branches/LiquidationBranch.sol#L244-L252) in LiquidationBranch::LiquidateAccounts() after liquidating account's positions

The issue is that the event is emitting [ctx.activeMarketsIds.length](https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/perpetuals/branches/LiquidationBranch.sol#L247-L247) which represents the number of open positions/markets the account had [before** liquidation**](https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/perpetuals/branches/LiquidationBranch.sol#L168-L168) not after. while the point of the event is to emit amountOfOpenPositions after the liquidations. Since the positions are [cleared](https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/perpetuals/branches/LiquidationBranch.sol#L206-L206) during the liquidation process and the [active markets]( https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/perpetuals/branches/LiquidationBranch.sol#L210-L210) are updated i.e removed, the emitted value doesn't accurately reflect the final state

Impact

Incorrect value emission could lead to confusion for those consuming the event data who might assume the number represents the final state rather than the initial state. The event should be clear about what exactly it's reporting since zaros also has an offchain element, incorrect data could disrupt operations

Tools Used

Manual Review

Recommendations

track and emit the actual number of active positions remaining after liquidations

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

seraviz Submitter
4 months ago
inallhonesty Lead Judge
4 months ago
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

wrong value emitted in `LogLiquidateAccount` event

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.