Part 2

Summary

The liquidateAccounts function uses an unconstrained mark price calculation that could lead to incorrect valuations during liquidations, potentially resulting in unfair liquidation amounts.

While the liquidateAccounts function intentionally bypasses skew checks during liquidation to prevent DoS attacks, it still relies on the getMarkPrice function which performs unconstrained price impact calculations. This creates a risk of mispriced liquidations.

The unbounded mark price flows through the following sequence:

1. Mark price calculation uses unconstrained skew values

2. This price is used to calculate position notional values

3. Notional values determine collateral deduction via deductAccountMargin

4. Final liquidation proceeds are based on these calculations

The getMarkPrice function does not bound its price impact calculations to respect maxSkew limits, even though these values are configured in the protocol. While skew limit bypassing during liquidation is intentional for execution purposes, the lack of bounds in price calculation could lead to extreme price impacts.

Proof of Concept

1. Market has high skew near maxSkew limit

2. Large position requires liquidation

3. Mark price calculation uses unbounded skew values

4. Results in extreme price impact

5. Position is liquidated at incorrect value

6. Either liquidated user loses excess funds or protocol receives insufficient value

Impact

Since the mark price calculation uses unconstrained skew values during liquidation valuation, positions can be liquidated at prices that significantly deviate from fair market value. Large positions near or beyond skew limits could experience extreme price impacts, leading to substantial mispricing during the liquidation. This affects the notional value calculation which directly determines the liquidation proceeds, potentially causing material losses to either the liquidated user (if overvalued) or the protocol (if undervalued). While this only impacts positions being liquidated, the magnitude of potential mispricing for individual liquidations is unbounded mathematically within the code, warranting a high severity rating.

Recommendation

Add price impact bounds to getMarkPrice:

This maintains the ability to execute liquidations beyond skew limits while ensuring price impacts remain bounded.