Liquidity Management

Summary

• runNextAction() function assumes that the position remains open when executing the next action.
  However, external factors (such as liquidations, manual keeper interventions, or market movement) may close the position before runNextAction() executes. If this happens the function could wrongly executes an increase action on a non-existence position, leading to incorrect trades and inconsistent contract state.

Vulnerability Details

• The keeper calls run(false, isLong, prices, metadata), intending to close an open position.

• The function successfully closes the position and sets nextAction.selector = INCREASE_ACTION, assuming the next step will reopen a new trade.

• Before runNextAction() is executed, something unexpected happens:

  • The market moves significantly, making the planned increase trade invalid.

  • A liquidation event occured, setting positionIsClosed = true.

  • A keeper manually intervenes and cancel the trade.

• The function blindly executes the increase action, assuming the position is still open.

• Since the position is actually closed this can lead to:

  • An unintended new position opening.

  • A trade failure due to invalid conditions

  • Incorrect vault accounting.

Impact

• Trading errors

• State inconsistency

• Potential exploit: An attacker or a front-runner could manipulate market conditions to trigger a liquidation before runNextAction() runs, potentially forcing unintended trades.

Tools Used

Manual Review

Recommendations

Before executing _createIncreasePosition(), add a check to ensure positionIsClosed == false: