Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Price Validation for Long and Short Tokens:

dsbex

Summary

The KeeperProxy::_validatePrice function contains incorrect price validation logic for the longToken. Specifically, it incorrectly checks the indexTokenPrice instead of the correct longTokenPrice.

Vulnerability Details

In the _validatePrice function, the contract validates the marketData.longToken price using indexTokenPrice, which is incorrect:

_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
@> _check(marketData.longToken, prices.indexTokenPrice.min);
@> _check(marketData.longToken, prices.indexTokenPrice.max);
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);

This results in improper price validation for long positions, potentially allowing incorrect price discrepancies.

Impact

This bug can cause the following issues:

  1. Incorrect Price Validation: The long token's price is checked against an unrelated index token price, leading to inaccurate price validation.

  2. Potential Exploits: If incorrect price thresholds are used, keepers may be able to execute actions based on invalid price data, causing financial losses.

  3. Operational Issues: The contract may reject valid transactions or accept invalid ones, leading to inefficiencies and potential risks for users.

Tools Used

Manual review

Recommendations

Modify _validatePrice to correctly check longTokenPrice for marketData.longToken:

_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
_check(marketData.longToken, prices.longTokenPrice.min);
_check(marketData.longToken, prices.longTokenPrice.max);
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);

This fix ensures that each token’s price is validated correctly against its respective price feed.

Updates

Lead Judging Commences

n0kto Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_validatePrice_no_check_for_longTokenPrice

Likelihood: None/Very Low, everytime the keeper send a price via run/runNextAction (sent by the Gamma keeper). Impact: Medium/High, does not check the longTokenPrice, it could go out of range. Keep in mind indexToken == longToken, an error from the keeper could be considered informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.