Summary

The VaultReader contract determines a position's net value by converting collateral and fee amounts into their USD equivalents. Currently, it utilizes the minimum price (e.g., prices.shortTokenPrice.min and prices.longTokenPrice.min) for these conversions. A comment in the code suggests that using the maximum price for fee calculations could help ensure appropriate fee collection under volatile market conditions. While this issue is of low severity, it may result in undercharging fees and create economic imbalances over time.

Vulnerability Details

• Current Implementation: The contract computes the net value as follows:

  uint256 netValue =

  positionInfo.position.numbers.collateralAmount * prices.shortTokenPrice.min +

  positionInfo.fees.funding.claimableLongTokenAmount * prices.longTokenPrice.min +

  positionInfo.fees.funding.claimableShortTokenAmount * prices.shortTokenPrice.min -

  positionInfo.fees.borrowing.borrowingFeeUsd -

  positionInfo.fees.funding.fundingFeeAmount * prices.shortTokenPrice.min -

  positionInfo.fees.positionFeeAmount * prices.shortTokenPrice.min;

  if (positionInfo.basePnlUsd >= 0) {

  netValue = netValue + uint256(positionInfo.basePnlUsd);

  } else {

  netValue = netValue - uint256(-positionInfo.basePnlUsd);

  }

  ​

  • Collateral Conversion: Collateral amounts are converted into USD using prices.shortTokenPrice.min.

  • Fee Deductions: Fees (funding, borrowing, and position fees) are also calculated using prices.shortTokenPrice.min.

• Identified Issue: A comment in the code suggests that fee conversion might be more accurate if based on the maximum price instead. If the actual market price is higher than the minimum price, using the minimum price undervalues fees in USD terms, leading to potential undercharging.

Impact

• Undercharged Fees: When the market price exceeds the minimum oracle price, the conversion results in a lower USD fee amount than intended. While this discrepancy may seem minor per transaction, frequent occurrences in volatile markets could lead to significant cumulative undercharges.

Tools Used

• Manual Code Review: A thorough examination of the VaultReader contract’s net value calculation logic.

Recommendations

1. Reassess Fee Conversion Price Basis:

   • Consider using prices.shortTokenPrice.max (and prices.longTokenPrice.max for long token fees) to ensure fees are collected at their appropriate USD value.

   • This approach would help maintain the intended fee collection mechanism and prevent economic imbalances caused by undercharging.