Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Integer Underflow in VaultReader::getPositionInfo Function

josh4324

Summary

The getPositionInfo function calculates the net value of a position by adding/subtracting different fees and values. However, there is a critical issue when handling the positionInfo.basePnlUsd, which can be negative. Since netValue is of type uint256, subtracting a large negative value from it can cause an underflow, leading to a revert.

Vulnerability Details

function getPositionInfo(
bytes32 key,
MarketPrices memory prices
) external view returns (PositionData memory) {
uint256 sizeInTokens = getPositionSizeInUsd(key);
if (sizeInTokens == 0) {
return PositionData({
sizeInUsd: 0,
sizeInTokens: 0,
collateralAmount: 0,
netValue: 0,
pnl: 0,
isLong: true
});
}
PositionInfo memory positionInfo = gmxReader.getPositionInfo(
address(dataStore),
referralStorage,
key,
prices,
uint256(0),
address(0),
true
);
uint256 netValue =
positionInfo.position.numbers.collateralAmount * prices.shortTokenPrice.min +
positionInfo.fees.funding.claimableLongTokenAmount * prices.longTokenPrice.min +
positionInfo.fees.funding.claimableShortTokenAmount * prices.shortTokenPrice.min -
positionInfo.fees.borrowing.borrowingFeeUsd -
positionInfo.fees.funding.fundingFeeAmount * prices.shortTokenPrice.min -
positionInfo.fees.positionFeeAmount * prices.shortTokenPrice.min;
if (positionInfo.basePnlUsd >= 0) {
netValue = netValue + uint256(positionInfo.basePnlUsd);
} else {
@> netValue = netValue - uint256(-positionInfo.basePnlUsd);
}
​
return PositionData({
sizeInUsd: positionInfo.position.numbers.sizeInUsd,
sizeInTokens: positionInfo.position.numbers.sizeInTokens,
collateralAmount: positionInfo.position.numbers.collateralAmount,
netValue: netValue,
pnl: positionInfo.basePnlUsd,
isLong: positionInfo.position.flags.isLong
});
}

positionInfo.basePnlUsd is an int256, meaning it can be negative.

The function attempts to subtract uint256(-positionInfo.basePnlUsd) from netValue when positionInfo.basePnlUsd < 0.

If netValue is smaller than uint256(-positionInfo.basePnlUsd), an underflow occurs, causing the entire transaction to revert.

Impact

if uint256(-positionInfo.basePnlUsd) is larger than netValue, the transaction fails.

Tools Used

Manual Review

Recommendations

netvalue should be changed to int256 not uint256, so it can handle negative values.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!