Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Misleading Variable Naming Leading to Position Size Calculation Error

juggernaut63

Summary

A critical naming error in the getPositionInfo function of the VaultReader contract could lead to incorrect position size calculations. The function retrieves a USD value but stores it in a variable indicating the number of tokens.

Vulnerability Details

function getPositionInfo(bytes32 key, MarketPrices memory prices)
external view returns (PositionData memory) {
uint256 sizeInTokens = getPositionSizeInUsd(key); // CRITICAL ISSUE
if (sizeInTokens == 0) {
return PositionData({
sizeInUsd: 0,
sizeInTokens: 0,
collateralAmount: 0,
netValue: 0,
pnl: 0,
isLong: true
});
}
// ... subsequent calculations using sizeInTokens
}

In the getPositionInfo function the variable is named sizeInTokens, but it takes the value in USD from the getPositionSizeInUsd function. This violates the "Clean Code" principle where the variable name should reflect its contents.

Developers using the sizeInTokens variable assume its value is in tokens. This can lead to incorrect calculations when used in mathematical operations.

Impact

Incorrect position sizing leading to wrong risk calculations

Scenario

  1. User opens a position worth 10 ETH (@ $2000/ETH = $20,000)

  2. getPositionInfo is called to calculate position metrics

  3. sizeInTokens receives 20,000 (USD value) from getPositionSizeInUsd

  4. Subsequent calculations treat 20,000 as token amount instead of USD

  5. Results in 2000% overvaluation of position (20,000 ETH vs 10 ETH)

Tools Used

  • Manual review

Recommendations

Change the variables appropriately.

uint256 positionSizeUsd = getPositionSizeInUsd(key);
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_getPosition_sizeInTokens_value_in_USD

Only check if there are no tokens. Checking if USD is 0 is equivalent. There is no problem here, even if the variable has an incorrect name: Informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.