Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Uninitialized prices value could cause DoS in the deposit function.

typical_human

Summary

The protocol uses an uninitialized prices value in the deposit function. The prices value is used only in one specific case, but since it is not initialized, all price values will be zero. As a result, the formula will always revert due to division by zero, making the deposit function fail in 100% of cases.

Vulnerability Details

Let's examine a section of the deposit function:

if (positionIsClosed) {
MarketPrices memory prices;
@> _mint(counter, amount, false, prices);
_finalize(hex'');
}

As we can see, an uninitialized prices value is passed to the _mint function, which is called here:

function _mint(uint256 depositId, uint256 amount, bool refundFee, MarketPrices memory prices) internal {
uint256 _shares;
if (totalShares == 0) {
_shares = depositInfo[depositId].amount * 1e8;
} else {
uint256 totalAmountBefore;
if (!positionIsClosed && _isLongOneLeverage(beenLong)) {
totalAmountBefore = IERC20(indexToken).balanceOf(address(this)) - amount;
} else {
@> totalAmountBefore = _totalAmount(prices) - amount;
}
if (totalAmountBefore == 0) totalAmountBefore = 1;
_shares = (amount * totalShares) / totalAmountBefore;
}
}

The problematic line is:

totalAmountBefore = _totalAmount(prices) - amount;

If we examine the _totalAmount function, we see the following formula:

function _totalAmount(MarketPrices memory prices) internal view returns (uint256) {
if (positionIsClosed) {
return collateralToken.balanceOf(address(this));
} else {
IVaultReader.PositionData memory positionData = vaultReader.getPositionInfo(curPositionKey, prices);
uint256 total = (IERC20(indexToken).balanceOf(address(this)) * prices.indexTokenPrice.min / prices.shortTokenPrice.min)
+ collateralToken.balanceOf(address(this))
+ (positionData.netValue / prices.shortTokenPrice.min);
​
return total;
}
}

In the else condition, prices values are used in mathematical operations, including division. However, since prices.shortTokenPrice.min is always 0 (due to prices being uninitialized), the division will always revert. This causes the deposit function to fail, blocking execution until certain internal parameters (such as positionIsClosed) are changed.

Impact

The deposit function becomes blocked and unusable.

Tools Used

Manual review.

Recommendations

Ensure that even if an uninitialized prices value is used, the formula does not result in division by zero.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.