Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Access Control in getPositionInfo()

0xkimonic

Summary

The getPositionInfo() function lacks access control, allowing any external user to retrieve sensitive position details, including size, collateral, and unrealized PnL.

This exposes pending trades, liquidations, and position details, making traders vulnerable to front-running and MEV attacks.

Vulnerability Details

The function does not implement any authentication or permission check.

It exposes real-time trading positions, which MEV bots or attackers can use to exploit liquidation thresholds.

Attackers can monitor low-margin traders and execute trades to force liquidations.

POC

  1. Call getPositionInfo(key, prices) from an unauthorized external account.

  2. Observe sensitive position details such as collateralAmount, sizeInTokens, and netValue.

  3. Use this information to place front-running or sniping orders before liquidations.

contract Exploit {
VaultReader public vaultReader;
constructor(address _vaultReader) {
vaultReader = VaultReader(_vaultReader);
}
​
function exploit(bytes32 positionKey, VaultReader.MarketPrices memory prices) external view {
VaultReader.PositionData memory position = vaultReader.getPositionInfo(positionKey, prices);
console.log("Collateral:", position.collateralAmount);
console.log("PnL:", position.pnl);
}
}
​

Impact

Trader privacy is compromised—attackers can monitor positions in real-time.

MEV bots can front-run liquidations, worsening price impacts.

Tools Used

Manual Review
Foundry

Recommendations

Implement access control using onlyKeeper, whitelist, or authenticated accounts.

Obfuscate or delay real-time position updates to prevent easy MEV exploitation.

Consider batching multiple transactions to hide individual liquidation thresholds.

Use commit-reveal pattern and/or implement flashbots.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!