Liquidity Management

Summary

In the afterLiquidationExecution function, when the flow is set to FLOW.DEPOSIT, the flowData variable is updated with sizeInTokens, but no next action is assigned. This could lead to an incomplete or incorrect flow execution since there is no explicit instruction for the contract to proceed with an INCREASE_ACTION after a deposit-related liquidation event.

Vulnerability Details

The function is responsible for handling the aftermath of liquidation and ensuring that the system continues its expected operation. When flow == FLOW.DEPOSIT, the code only updates flowData, but does not assign a nextAction.selector.

Potential issues that may arise:

• The contract may not properly proceed with increasing the position after liquidation.

• The keeper might not be able to initiate a new order with the liquidated funds as intended.

• The execution logic could become stuck or inconsistent, leading to improper fund management.

Impact

• The deposit flow might not continue correctly after liquidation.

• The keeper may be unable to reopen positions, leading to potential missed trading opportunities.

• The contract state could become inconsistent, affecting user funds and strategy execution.

Tools Used

• Manual Code Review

Recommendations

• Explicitly assign the next action selector when flow == FLOW.DEPOSIT.

• Modify the function to include:

  if (flow == FLOW.DEPOSIT) {

  flowData = sizeInTokens;

  nextAction.selector = NextActionSelector.INCREASE_ACTION;

  }

Adding nextAction.selector = NextActionSelector.INCREASE_ACTION; ensures that after liquidation in the deposit flow, the contract correctly transitions to the next step.