Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Price Validation for Long and Short Tokens:

dsbex

Summary

The KeeperProxy::_validatePrice function contains incorrect price validation logic for the longToken. Specifically, it incorrectly checks the indexTokenPrice instead of the correct longTokenPrice.

Vulnerability Details

In the _validatePrice function, the contract validates the marketData.longToken price using indexTokenPrice, which is incorrect:

_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
@> _check(marketData.longToken, prices.indexTokenPrice.min);
@> _check(marketData.longToken, prices.indexTokenPrice.max);
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);

This results in improper price validation for long positions, potentially allowing incorrect price discrepancies.

Impact

This bug can cause the following issues:

  1. Incorrect Price Validation: The long token's price is checked against an unrelated index token price, leading to inaccurate price validation.

  2. Potential Exploits: If incorrect price thresholds are used, keepers may be able to execute actions based on invalid price data, causing financial losses.

  3. Operational Issues: The contract may reject valid transactions or accept invalid ones, leading to inefficiencies and potential risks for users.

Tools Used

Manual review

Recommendations

Modify _validatePrice to correctly check longTokenPrice for marketData.longToken:

_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
_check(marketData.longToken, prices.longTokenPrice.min);
_check(marketData.longToken, prices.longTokenPrice.max);
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);

This fix ensures that each token’s price is validated correctly against its respective price feed.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_validatePrice_no_check_for_longTokenPrice

Likelihood: None/Very Low, everytime the keeper send a price via run/runNextAction (sent by the Gamma keeper). Impact: Medium/High, does not check the longTokenPrice, it could go out of range. Keep in mind indexToken == longToken, an error from the keeper could be considered informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!