Part 2

Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Submission Details
Severity: high
Invalid

Incorrect swap amount calculation in RebalanceVaultAssets when the vault is in credit

Summary

The function calculateSwapAmount is called with parameters in an incorrect order, which may lead to incorrect swap calculations. The function is intended to calculate the amount of USDC to be swapped into the vault's underlying asset. However, the parameters for assetIn and assetOut are reversed.

Vulnerability Details

Relevant links:

Current Implementation below swaps the assets to usdc, whereas when the vault is in credit the usdc should be swapped to assets. This leads to incorrect swap being performed

ctx.usdcIn = calculateSwapAmount(
dexSwapStrategy.dexAdapter,
ctx.vaultAsset, // Incorrect: assetIn should be USDC
ctx.usdc, // Incorrect: assetOut should be vault asset
usdcCollateralConfig.convertSd59x18ToTokenAmount(ctx.vaultUnsettledRealizedDebtUsdX18.abs())
);

Impact

This issue can lead to incorrect calculations of the swap amount, potentially resulting in insufficient or excessive asset swaps. This could affect the vault's ability to settle its credit accurately, leading to financial discrepancies.

Tools Used

Manual review

Recommendations

Swap the parameters in the calculateSwapAmount function call to ensure the correct assets are being used for the swap calculation.

ctx.usdcIn = calculateSwapAmount(
dexSwapStrategy.dexAdapter,
ctx.usdc, // Correct: assetIn should be USDC
ctx.vaultAsset, // Correct: assetOut should be vault asset
usdcCollateralConfig.convertSd59x18ToTokenAmount(ctx.vaultUnsettledRealizedDebtUsdX18.abs())
);
Updates

Lead Judging Commences

inallhonesty Lead Judge
4 months ago
inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.