Submission Details
Severity:
feeAmount not rounded in protocol's favour during withdrawal
Description
feeAmount calculation needs to be in favour of the protocol. The correct code ought to be:
- uint256 feeAmount = vaultReader.getPositionFeeUsd(market, sizeDeltaInUsd, false) / prices.shortTokenPrice.max;
+ uint256 feeAmount = vaultReader.getPositionFeeUsd(market, sizeDeltaInUsd, false) / prices.shortTokenPrice.min;
Division should occur by shortToken's min price, not the max price.
Impact
Protocol receives less fees and user is able to withdraw more.
Updates
Lead Judging Commences
n0kto 9 months ago
Submission Judgement Published Assigned finding tags:
finding_withdraw_use_prices.shortTokenPrice.max_instead_of_min
Likelihood: Low/Medium, every withdraw, position opened, not liquidated, beenShort or not 1, and the difference between minPrice and maxPrice is significant. Impact: Low, small part of feeAmount and PnL not deducted from collateralDeltaAmount.
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026
USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.