Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Open Interest Underflow Vulnerability

kimnoic

Summary

A critical integer underflow vulnerability exists in the sumReturnUint256 function when handling negative open interest adjustments. This allows malicious actors to manipulate collateral requirements and trigger unintended liquidations.

Vulnerability Details

Affected Code

function sumReturnUint256(uint256 a, int256 b) internal pure returns (uint256) {
if (b > 0) {
return a + uint256(b);
}
return a - uint256(-b); // Underflow risk
}

Technical Analysis

  • When b is negative and uint256(-b) > a, subtraction underflows

  • Returns extremely large value (2^256 - difference)

  • Affects getMinCollateralFactorForOpenInterest calculation:

    SOLIDITY

    openInterest = sumReturnUint256(openInterest, openInterestDelta);

Attack Scenario

  1. Market with 100 ETH open interest

  2. Attacker submits -150 ETH delta

  3. sumReturnUint256(100, -150) → 2^256 - 50

  4. Min collateral factor becomes astronomically high

  5. All positions appear undercollateralized

Impact

  • Protocol risk calculations become unreliable

  • Potential complete depletion of collateral pools

Tools Used

Manual review

Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.