Liquidity Management

Summary

Once the vault is completely liquidated , totalDepositAmount remains unchanged.
Even when the withdrawer(deposit) tries to withdraw , totalDepositAMount is not reduced by the depositInfo[depositId].amount.

As a result new deposits be incorrectly rejected due to false "maxCapReached" errors.

Vulnerability Details

When the perpetualVault is completely liquidated in such a way the collatteralToken in the position is 0 , the currPositionKey is made 0 but the position remains open. code

This allows the the vault to continue the other user Operations like withdraw() and also the deposit() when the owner disable the depositPaused.

Now when user executes withdraw , this code willl get executed.

Inside the _handleReturn() the amount to transfer is calculated as

The balance of the contract would be 0 by this time.
=> amount = 0;

As a result the fun _transferToken() will not get executed and also the totalDepositAmount is never get reduced.

Impact

The totalDepositAmount will never get reduced once the vault is liquidated and users start withdrawing.
Hence it always show the incorrect value after on.

New deposits be incorrectly rejected due to false "maxCapReached" errors.

Protocol accounting becomes inaccurate, making it difficult to track actual assets under management

Tools Used

Manual

Recommendations

the line totalDepositAmount -= depositInfo[depositId].amount; should be put outside the transferToken() function so that it will be executed whatsoever.

Another way is to delete the totalDepositAmount once the vault is completely liquidated.