Liquidity Management

Details:
The setMinMaxDepositAmount function in the PerpetualVault contract allows the owner to configure the minimum and maximum deposit amounts. However, the function does not enforce any validation rules to ensure that the _minDepositAmount is less than _maxDepositAmount or that the minimum deposit is set to a safe threshold. This oversight can lead to configurations where deposits become impossible or unsafe, depending on how these parameters are set.

Root Cause:
Lack of input validation checks within the setMinMaxDepositAmount function. The function directly assigns the provided values without verifying:

• That _minDepositAmount is lower than _maxDepositAmount.

• That _minDepositAmount is not set to a value too low, which could open avenues for potential exploits.

Impact:

• Operational Disruption: If _minDepositAmount is mistakenly set higher than _maxDepositAmount, it would block any deposit attempts, potentially halting vault operations.

• Security Concerns: Setting the minimum deposit amount too low might expose the system to exploitation, as it could allow users to bypass intended economic constraints.

• Human Error: Even though the function is owner-restricted, misconfiguration by the owner (or a compromised admin account) could lead to unintended and adverse system behavior.

Recommendation:

• Enforce Order Constraint: Add a check to ensure that _minDepositAmount is strictly less than _maxDepositAmount.

  require(_minDepositAmount < _maxDepositAmount, "minDepositAmount must be less than maxDepositAmount");

• Enforce Safe Thresholds: Optionally, enforce that _minDepositAmount meets a minimum value (e.g., 1000) and _maxDepositAmount does not exceed a maximum value (e.g., 100000) as per the README guidelines.

  require(_minDepositAmount >= 1000, "minDepositAmount too low");

  require(_maxDepositAmount <= 100000, "maxDepositAmount too high");

• Documentation: Update the documentation to clearly state the acceptable range for deposit amounts to avoid misconfiguration.

Proof of Concept:

1. The owner calls setMinMaxDepositAmount with the following parameters:

   • _minDepositAmount = 200000

   • _maxDepositAmount = 100000

2. Since there is no validation, the contract accepts these values.

3. As a result, any deposit operation requiring an amount between the minimum (200000) and maximum (100000) will fail, effectively preventing deposits and disrupting vault operations.

4. Similarly, if _minDepositAmount is set to an extremely low value (e.g., 0), it might allow deposits that should be considered unsafe per the system’s economic design.

Implementing the recommended checks would mitigate these risks by ensuring that the deposit boundaries are logically consistent and within acceptable limits.