Submission Details
Severity:
feeAmount not rounded in protocol's favour during withdrawal
Description
feeAmount calculation needs to be in favour of the protocol. The correct code ought to be:
- uint256 feeAmount = vaultReader.getPositionFeeUsd(market, sizeDeltaInUsd, false) / prices.shortTokenPrice.max;
+ uint256 feeAmount = vaultReader.getPositionFeeUsd(market, sizeDeltaInUsd, false) / prices.shortTokenPrice.min;
Division should occur by shortToken's min price, not the max price.
Impact
Protocol receives less fees and user is able to withdraw more.
Updates
Lead Judging Commences
n0kto 11 months ago
Submission Judgement Published Assigned finding tags:
finding_withdraw_use_prices.shortTokenPrice.max_instead_of_min
Likelihood: Low/Medium, every withdraw, position opened, not liquidated, beenShort or not 1, and the difference between minPrice and maxPrice is significant. Impact: Low, small part of feeAmount and PnL not deducted from collateralDeltaAmount.
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026
USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.