Liquidity Management

Summary

In PerpetualVault contract, user deposit and get shares based on deposited amount, the calculation of shares minted varies from position state and leverage value. When there is an opened position with 1x leverage, the minted share calculated is incorrect.

Vulnerability Details

Here in the part of perpetualVault::_mint:

We see, when position is opened, and is 1x leverage, totalAmountBefore is derived from balance of index token. The both amount and totalAmountBefore are used for share calculation. When vault is first deployed, most likely there isn't an opened position, and users deposit with positionIsClosed being true, their shares are calculated with amount of collateral token deposited. Now, for 1x leverage position, it's using totalShares, but accounting amount of index token, this is mixing up both shares from index tokens and collateral tokens.

For example, Alice deposited 1000 collateral tokens, with shares being 1000, totalShares being 10000, and totalAmountBefore also being 10000. Later, a position has been opened, and Bob deposited again, this time with 20 index token (about same value of 1000 collateral tokens), when totalAmountBefore in index token's balance is 40. So Bob would get 20 * 11000 / 40 = 5500 shares, which is way more than Alice's shares, despite having same value in collateral tokens.

Impact

Shares are calculated incorrectly for opened 1x leverage position, and will give later users more shares than intended.

Tools Used

Manual review

Recommendations

For total amount calculation, consider converting index token amount to collateral token's equivalent, then use converted amount for share calculation.