Liquidity Management

Summary

When a user calls deposit, execution fee is paid followed by INCREASE_ACTION if a position is already opened.
If runNextAction() is called by the keeper after that and vault is 1X leverage with only dexswap , it triggers _runSwap() followed by _mint() action. The call is completed but swapProgressData is not deleted violating the following invariant :

> After all actions completed, nextAction, swapProgressData should be empty. PositionKey is 0 when no positio

Vulnerability Details

This is our inital state :

1. Vault is of 1X leverage

2. Swap only happens with dex ( paraswap )

3. There is an open position in the vault

Suppose Alice calls deposit() with 100 collateral tokens.

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/PerpetualVault.sol#L215-L243

Since there is a position opened already, deposit will initiate INCREASE_ACTION.

```Solidity
if (positionIsClosed) {

MarketPrices memory prices;

_mint(counter, amount, false, prices);

_finalize(hex'');

} else {

_payExecutionFee(counter, true);

// mint share token in the NextAction to involve off-chain price data and improve security

nextAction.selector = NextActionSelector.INCREASE_ACTION;

nextAction.data = abi.encode(beenLong);

}
```

Keeper will call runNextAction() to increase position size. Keep in mind that flow is still DEPOSIT.

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/PerpetualVault.sol#L350-L409

Since vault is of 1X leverage , _isLongOneLeverage(_isLong) will be true and _runSwap() will be initiate

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/PerpetualVault.sol#L976-L1019

Assume that we are only swapping for dexSwap i.e. metadata = 1 and PROTOCOL = PROTOCOL.DEX
So, the below condition will be executed

```Solidity
else {

// some code....

if (flow == FLOW.DEPOSIT) {

// last `depositId` equals with `counter` because another deposit is not allowed before previous deposit is completely processed

_mint(counter, outputAmount + swapProgressData.swapped, true, prices);

}
// more code
```
Now, when _mint is executed , the function proceed to calculate the amount of shares that should be given to Alice based on the output amount of paraswap. The execution completed but at no point , flow, flowdata and swapProgressdata was deleted.

This breaks the core invariant mentioned in README.

Impact

Invariant Voilation. subsequent deposits and withdraw will not happen since flow is not deleted.
If swapProgress is not deleted and minting of shares can be altered.

Tools Used

Manual Review

Recommendations

Make sure to delete these values after the action is completed.