Liquidity Management

Summary

The net value calculation in VaultReader.getPositionInfo() function does not properly handle negative PnL, leading to an underflow that falsely inflates a position’s net value.

Vulnerability Details

In VaultReader.getPositionInfo, net value is computed by adding collateral and claimable amounts and then adjusting for the position’s PnL.

The code differentiates between positive and negative PnL as follows:

If the absolute value of the negative PnL exceeds the combined collateral and fee amounts, subtracting it in unsigned arithmetic will underflow, wrapping around to an extremely high value. This miscalculation misrepresents the true economic state of the position and violates the invariant that a depositor’s share value should not be reduced by others’ actions.

Affected Lines of Code:-

• A trader opens a position with collateral worth $100.

• Due to adverse price movements, the position incurs a negative PnL of $150.

• When getPositionInfo() is called, the net value is calculated as: netValue = 100 - 150
  Because the subtraction is performed using unsigned arithmetic, the result underflows and wraps around to a very large number (e.g., near 2^256-50).

Therefore, net value underflow, creating an artificial profits, enabling users to drain the vault.

Impact

Underflow in net value calculations can lead to users being able to withdraw more than their fair share even when they are in a loss state. This directly jeopardizes the fund’s accounting, leading to systematic financial losses for the protocol and its depositors.

Tools Used

Manual Review

Recommendations

Change the net value computation to use a signed integer throughout, then ensure the final value is nonnegative before converting to uint256. Also, introduce explicit checks that prevent subtraction from causing an underflow, reverting the transaction if a negative net value is detected.