Liquidity Management

Summary

VaultReader contract includes a function (willPositionCollateralBeInsufficient) that relies on a prorated calculation of basePnlUsd rather than accounting for real-time fees, funding, and price impact. This approach may underestimate the actual cost when positions are partially closed, leading to incorrect assumptions regarding collateral adequacy. For instance, if significant fees or negative price movements occur, the function could incorrectly conclude that a position remains safe, exposing users to potential collateral shortfalls. This risk emerges because the calculated “realized PnL” omits critical variables that would more accurately reflect the net outcome of a partial close.

Vulnerability Details

This issue arises from relying exclusively on basePnlUsd when determining the realized PnL for partial position closures. Since additional fees (such as opening/closing costs, funding, and price impact) are ignored, willPositionCollateralBeInsufficient may report collateral as sufficient even when it is actually at risk of a shortfall. In scenarios where negative price movements or high fees accumulate, the net proceeds from a partial close can differ significantly from the proration of basePnlUsd. Consequently, users might maintain positions under the mistaken belief that their collateral is safe, exposing them to liquidation or other unintended outcomes.

Impact

This logic flaw can cause erroneous assessments of collateral sufficiency, particularly when significant fees or negative price movements occur. The function may falsely signal that sufficient collateral remains, leading to situations where positions are not liquidated or adjusted in time. As a result, users could incur unexpected losses and the protocol itself may face financial exposure if positions remain undercollateralized. This discrepancy undermines the reliability of collateral checks and heightens the risk of detrimental outcomes for both users and the platform.

Proof of Concept

By calculating the “realized PnL” solely from basePnlUsd, the impact of price impact, fees (opening/closing), funding rates, and other adjustments may be substantially overlooked. Consequently, the willPositionCollateralBeInsufficient function bases its calculations on a partial or outdated PnL estimate, which can lead to erroneous conclusions about the adequacy of collateral.

Code Analysis

• VaultReader.sol - willPositionCollateralBeInsufficient

Below is the relevant portion of the function, highlighting where the issue occurs:

Explanation

The realizedPnlUsd calculation merely prorates basePnlUsd based on (sizeDeltaUsd / totalSizeUsd). In practice, users may face additional fees (e.g., opening/closing commissions, funding fees, negative price impact) when partially closing a position. Thus, the final amount that gets added or subtracted from the collateral may differ significantly from this simplistic proration, leading to incorrect assessments of collateral sufficiency.

Vulnerable Scenario

A possible scenario highlighting this vulnerability is when the user closes part of a position under high fees or price impact:

1. The user has accumulated substantial funding fees or adverse price impact.

2. positionInfo.basePnlUsd only reflects base profit/loss, without factoring in recent price impact or additional fees.

3. The system calculates a realizedPnlUsd that misses some or all of those extra costs.

4. As a result, willPositionCollateralBeInsufficient incorrectly deems the collateral sufficient, when in reality partial closure could incur substantial costs that leave the user with insufficient collateral.

Test and Result

This test deliberately introduces extra tokens to simulate unaccounted fees or a negative price impact. The function willPositionCollateralBeInsufficient then reports false—implying no collateral insufficiency—while we actually expect it to be true. As shown in the log output, this mismatch confirms the underlying logic omits certain costs from basePnlUsd and can inaccurately assess collateral adequacy, thereby passing the test and demonstrating the vulnerability.

• Add the following test to test/PerpetualVault.t.sol

Confirmation

Through testing and comparing the outcomes against scenarios that factor in fees and price impact, the results clearly demonstrate that willPositionCollateralBeInsufficient can give a misleading assessment. The system’s partial PnL calculation leads to underestimating costs, validating that collateral may appear sufficient when it is actually at risk.

Tools Used

Manual Code Review was performed to inspect the relevant contract code and identify the discrepancy in the partial PnL calculation.

Recommendations

Include all relevant factors (fees, funding, and price impact) in the partial PnL calculation instead of relying solely on basePnlUsd. For instance, use pnlAfterPriceImpactUsd or recalculate the additional fees/funding at runtime to ensure accurate collateral checks.