Summary

The vault redemption process contains a critical logic error that improperly validates credit capacity changes, allowing liquidity providers to withdraw locked collateral reserves. The VaultRouterBranch.redeem function incorrectly compares withdrawal amounts against the vault's locked credit capacity instead of its unlocked available balance, using an inverted inequality check. This permits withdrawals to consume capital reserved for market protection, enabling drainage of vault locked collateral as demonstrated by a proof-of-concept test. The vulnerability directly threatens protocol solvency by violating the core safety mechanism that maintains minimum collateral reserves for perpetual markets.

Vulnerability Details

Technical Root Cause:
The vulnerability originates from an inverted logical operator and incorrect reference value in the credit capacity delta validation. The protocol improperly compares the withdrawal-induced capacity reduction against the locked credit capacity reserve rather than the available unlocked capacity, using an inequality direction that permits dangerous withdrawals (VaultRouterBranch.sol#L556-L563):

Flawed Logic Breakdown:

1. Value Reference Error

   • Compares capacity reduction against locked reserves instead of unlocked capacity

   • Uses lockedCreditCapacity as threshold when should use (totalCapacity - lockedCapacity)

2. Inequality Direction Inversion

   • Employs lte() (≤) comparison when gt() (>) check required

   • Creates false negative scenario allowing overspending of reserves

3. Core Accounting Violation

   • Fails to maintain critical invariant: withdrawnAmount ≤ (totalCreditCapacity - lockedCreditCapacity)

   • Permits withdrawals to consume capital earmarked for market protection

Resulted Loss:

1. Normal Withdrawal Reverts

   • Legitimate withdrawals within unlocked capacity get rejected when they don't exceed locked reserves

   • Example: Trying to withdraw 10% of unlocked funds gets reverted

2. Invalid Large Withdrawals Succeed

   • Withdrawals exceeding unlocked capacity get approved by consuming locked reserves

   • Enables extraction of collateral buffer meant to prevent market liquidations

3. Hidden Liquidation Risk

   • Approved oversize withdrawals silently reduce vault collateralization

   • Creates delayed liquidation risk when markets experience volatility

   • Remaining LPs inherit undercollateralized positions unknowingly

Impact

High Severity Protocol Risk
This vulnerability enables liquidity providers to drain critical capital reserves, directly threatening protocol solvency and creating systemic risk for connected perpetual markets. The validated PoC demonstrates catastrophic failure of collateral protection mechanisms.

Key Impacts:

1. Protocol Insolvency Risk

   • Allows withdrawal of locked reserves meant to back perpetual market positions

   • PoC test shows complete vault drainage leaving 1 wei remaining capacity

   • Creates unbacked USDz liabilities when markets require collateral

2. LP/Trader Loss Escalation

   • Remaining LPs inherit undercollateralized vault positions

   • Traders face unrecoverable profits due to missing collateral

   • Violates core protocol guarantee of maintained credit capacity

3. Market Stability Compromise

   • Connected perpetual markets become undercollateralized

   • Triggers cascading liquidations during market stress events

   • Undermines trust in protocol's risk management systems

PoC Validation:

• test function test_InvalidRedeemSucceedDueToVulnerability of the contract Redeem_Integration_Test:

• test command

• test result

Tools Used

Manual Review

Recommendations

1. Operator change from lte to gt

2. Threshold calculation changed to (total - locked) capacity