Liquidity Management

Summary

The afterOrderExecution() function allow users to claim funding fees every time they executes a non market swap order. However, the function does not prevent repeated funding fee clams if a user splits a single large position reduction into multiple smaller ones. This allow a malicious user to claim an unfair share of funding fees by repeatedly submitting small MarketDecrease orders, resetting the claim mechanism each time due to the queue deletion at the end of execution.

This misaligns incentives and allow malicious users to drain funding fees at the expense of other depositors.

Vulnerability Details

• Open a large leverage position in a vault

• Instead of closing 50% of the position in one transaction, execute five separate MarketDecrese transactions, each reducing by 10% or less.

• After each MarketDecrease order, funding fees are claimed again despite being part of the same overall position reduction.

• Observe that the total funding received exceed what would have been granted in a single 50% reduction.

Impact

• Users can extract disproportionate funding fees by making multiple small reductions in quick succession.

• This unfairly shifts funding fee distributions, draining rewards from other legitimate users.

• Incentives misalignment which encourage exploitative behavior where users maximize claims by gaming position reductions instead of trading efficiently.

Tools Used

Manual Review

Recommendations

Since funding fee is enable to OrderType.MarketDecrease
And authorized role are the one executing it
The recommendation for this exploit is
Limit claimable funding fee to each size
Example: