Part 2

Description

The CreditDelegationBranch contract uses an auto-deleverage factor calculation to manage market risk through a polynomial regression curve. A critical vulnerability has been identified in the getAutoDeleverageFactor function where equal auto-deleverage start and end thresholds trigger a division by zero, leading to system-wide paralysis.

The issue occurs in the core ADL calculation:

When autoDeleverageEndThresholdX18 equals autoDeleverageStartThresholdX18, the division operation triggers a revert, propagating failures throughout the system's risk management infrastructure.

Impact

The Auto-Deleverage System forms the core risk management infrastructure, controlling USD token minting, profit calculations, and position management. When the division by zero occurs, it triggers a cascade of failures across these interconnected components. Market participants find themselves unable to execute token operations, calculate profits, or adjust positions. The risk management system becomes paralyzed precisely when market stress requires its intervention.

This paralysis extends beyond immediate transaction failures. Token withdrawals become blocked, preventing users from accessing their funds. Position adjustments freeze, leaving traders exposed to market movements. Most critically, the system's self-healing mechanisms become inoperable, preventing recovery from the stressed state.

Fix

The solution requires a multi-layered defense approach. At the configuration level:

With runtime safety checks:

And emergency fallback protection:

These layered protections ensure system stability while maintaining risk management functionality during market stress periods. The severity is critical as the vulnerability can completely disable core market operations.