Liquidity Management

Summary

The ParaSwapUtils._validateCallData() function attempts to validate the receiver address from Paraswap's simpleSwap() calldata, but incorrectly reads expectedAmount instead. This causes all validation checks to fail since it compares a uint256 value (implicitly cast to address) with address(this), effectively blocking all Paraswap operations in the PerpetualVault contract.

Vulnerability Details

The _validateCallData() function attempts to validate the calldata by checking if the receiver matches address(this):

The SimpleData struct layout shows that offset 196 actually points to expectedAmount:

Two critical issues:

1. The SimpleData struct doesn't contain a receiver field

2. The function reads expectedAmount (a uint256) and implicitly casts it to address before comparison

3. The probability of a uint256 value matching address(this) is practically zero.

Impact Details

This validation error causes a complete denial of service for all Paraswap operations in the PerpetualVault contract. Users cannot perform deposits or withdrawals that require token swaps through Paraswap, as all such transactions will revert at the validation step. This effectively breaks core functionality of the protocol when Paraswap integration is needed.

Tools Used

Manual Review

Recommendations

Remove the receiver validation since SimpleData doesn't contain such a field. If additional validation is required, it should be based on actual fields in the SimpleData struct:

If receiver validation is deemed necessary, ensure proper documentation of the receiver's location in the calldata and verify that the validation logic aligns with Paraswap's actual implementation.