Summary

flow variable that is used to prevent user interactions while its in progress does not reset as none when the case that 1x leverage and swap using only dex at _runnext function at Deposit flow inPerpetualVault.sol.

Vulnerability Details

The contract's execution flow is flawed when an off-chain keeper selects a DEX for swapping after a user deposits tokens for a long position(1x leverage and swap using only dex). The finalize function is not called in this scenario, leaving flow data uncleared. Consequently, all non-flow functions become inoperable so admin should call cancelFlow() function but it is also stuck when there's no enough collateral balance to refund to the user, effectively halting the contract and creating a denial-of-service condition. This issue can be exploited to freeze the contract's functionality.

Impact

The failure to clear flow data leads to a denial-of-service condition before , as all non-flow functions become inoperable, effectively halting the contract's functionality.

Tools Used

Mannual review

Recommendations

Should clear flow data by calling finalize function after [mint](https://github.com/CodeHawks-Contests/2025-02-gamma/blob/main/contracts/PerpetualVault.sol#L1005).