Liquidity Management

Summary

The getPriceImpactInCollateral function calculates expectedSizeInTokensDelta using division before multiplication, leading to truncation errors. This results in understated price impact values, causing inaccurate loss calculations during swaps or leverage adjustments.

Vulnerability Details

Code Snippet

Root Cause

• Division Before Multiplication:

  • sizeDeltaInUsd / prices.indexTokenPrice.min truncates fractional values due to integer division.

  • Example: If sizeDeltaInUsd = 1500e30 (1,500 USD) and prices.indexTokenPrice.min = 2000e30 ($2,000 per token), the division yields 0.75 tokens, which truncates to 0 in integer math.

  • Subsequent multiplication (0 * price) results in zero price impact, even though the actual impact should be non-zero.

Impact

• Understated Losses: Traders may incur larger-than-expected losses during swaps or leverage changes.

• Protocol Insolvency Risk: Miscalculations could lead to insufficient collateral reserves to cover actual losses.

Proof of Concept (PoC)

Scenario

1. Input Values:

   • sizeDeltaInUsd = 1500e30 ($1,500)

   • prices.indexTokenPrice.min = 2000e30 ($2,000 per token)

   • prices.shortTokenPrice.min = 1e30 ($1.00)

2. Faulty Calculation:

   • expectedSizeInTokensDelta = 1500e30 / 2000e30 = 0 (truncated from 0.75).

   • priceImpactInTokens = 0 - realSizeInTokensDelta (assume realSizeInTokensDelta = 0.5).

   • priceImpactInCollateralTokens = (-0.5) * 2000e30 / 1e30 = -1000e30 (-$1,000).

3. Correct Calculation (Multiplication First):

   • expectedSizeInTokensDelta = (1500e30 * 1e30) / 2000e30 = 750e27 (0.75 tokens).

   • priceImpactInTokens = 0.75 - 0.5 = 0.25.

   • priceImpactInCollateralTokens = 0.25 * 2000e30 / 1e30 = 500e30 ($500).

Result: The protocol understates the price impact by **1,000vs.+$500`), leading to incorrect loss reporting.

Recommended Mitigation

Re-Order Operations

Perform multiplication before division to preserve precision:

Use Higher Precision

Add a scaling factor (e.g., 1e18) to minimize truncation: