Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect Handling of Zero PositionFeeFactor

scoolj

Summary

The getPositionFeeUsd function in the VaultReader contract does not handle the case where the positionFeeFactor is zero, which can lead to incorrect fee calculations.

Vulnerability Details

The getPositionFeeUsd function calculates the position fee in USD for a given market and size delta. It retrieves the positionFeeFactor from the dataStore and uses it to calculate the fee. However, if the positionFeeFactor is zero, the calculated fee will also be zero, which may not be the intended behavior.

Root Cause:
The root cause of this issue is the lack of a check for a zero positionFeeFactor in the getPositionFeeUsd function. The function directly uses the retrieved positionFeeFactor without verifying its validity.

Impact

If the positionFeeFactor is zero, the calculated position fee will be zero, potentially leading to incorrect fee calculations and loss of revenue for the protocol. This can occur if the positionFeeFactor is set to zero during updates or if it is not properly initialized.

Tools Used

Manual

Recommendations

To mitigate this issue, add a check for a zero positionFeeFactor in the getPositionFeeUsd function. If the positionFeeFactor is zero, revert the transaction or set a default minimum fee.

Example of improved getPositionFeeUsd function:

function getPositionFeeUsd(address market, uint256 sizeDeltaUsd, bool forPositiveImpact) external view returns (uint256 positionFeeAmount) {
uint256 positionFeeFactor = dataStore.getUint(keccak256(abi.encode(
POSITION_FEE_FACTOR,
market,
forPositiveImpact
)));
require(positionFeeFactor > 0, "Position fee factor is zero");
positionFeeAmount = sizeDeltaUsd * positionFeeFactor / PRECISION;
}
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!