Summary

A critical vulnerability exists in the Vault contract's credit capacity recalculation logic where connected market IDs are improperly cached. The code initializes an empty array for market IDs but fails to populate it with actual data from storage. This results in:

1. Invalid Market References - Subsequent calculations use zero-value market IDs that don't exist

2. Broken Risk Management - Credit delegation and exposure limits become mathematically meaningless

3. Protocol-Wide Accounting Errors - All vault credit capacity calculations reference non-existent markets

This flaw fundamentally undermines the protocol's ability to maintain accurate collateralization ratios, creating systemic risk of undercollateralized positions and potential protocol insolvency during normal operations.

Vulnerability Details

The vulnerability occurs in the credit capacity recalculation logic where connected market IDs are improperly cached. In function Vault.recalculateVaultsCreditCapacity (Vault.sol#L386), the code initializes an empty array for market IDs cache but fails to populate it with actual data from storage. This results in subsequent functions:

1. Vault.updateVaultAndCreditDelegationWeight

2. Vault._recalculateConnectedMarketsState

3. Vault._updateCreditDelegations

operating on invalid market ID data. The cache array length is correctly set but remains unpopulated, causing all market ID values to default to zero (empty array values in Solidity memory):

This flaw fundamentally breaks the credit capacity calculation process as:

• Zero market IDs don't correspond to actual markets

• Risk exposure calculations become mathematically invalid

• Protocol state transitions occur based on non-existent markets

The root cause is the missing population loop between cache initialization and usage. The cache array should be filled with actual market IDs from the connectedMarkets EnumerableSet storage before being used in downstream calculations.

Impact

This critical accounting error directly impacts protocol solvency and risk management in three key ways:

1. Incorrect Credit Capacity Exposure
   Vaults will report inflated/incorrect credit availability to markets, enabling over-leveraged positions that could lead to protocol insolvency during market volatility

2. Broken Risk Isolation
   The core safety mechanism of market-specific credit delegation fails, allowing risk contagion between unrelated markets through miscalculated exposure limits

3. LP Fund Mismanagement
   Liquidity provider deposits become misallocated as credit delegations reference non-existent markets, potentially leading to unrecoverable fund lockups

The vulnerability fundamentally undermines the protocol's ability to maintain proper collateralization ratios, creating systemic risk where properly collateralized positions could be liquidated due to faulty global credit calculations. This could lead to direct fund losses for LPs and traders through improper liquidations and credit allocation.

Tools Used

Manual Review

Recommendations

The critical fix requires populating the market ID cache with actual data from storage. Modify the affected code section in Vault.sol#L386 to:

This change ensures the cache contains real market IDs before being used in credit capacity calculations. The loop converts the EnumerableSet storage into a memory array of valid market IDs, preserving data integrity for downstream operations.