Liquidity Management

Summary

The _totalAmount function in the PerpetualVault contract calculates the total value of the vault using the balanceOf method to retrieve the balance of tokens held by the contract. However, this approach can lead to inaccurate calculations, especially in cases where tokens are directly sent to the contract. This can cause discrepancies as the contract’s state variables may not reflect the updated token balance.

Vulnerability Details

The current implementation relies on the balanceOf(address(this)) method to determine the contract’s token balances for the calculation of the total vault value. This method can be manipulated if users send tokens directly to the contract (bypassing the contract’s functions), resulting in inaccurate balance tracking.

Specific Issue:

1. Direct Token Transfers to Contract: Users can send tokens directly to the contract, which does not update the internal state variables that track balances (such as indexTokenBalance and collateralTokenBalance), potentially leading to an incorrect total value calculation.

2. Incorrect Vault Value Calculation: If tokens are transferred directly to the contract, the contract's state does not reflect this, but the balanceOf method is still called to determine the contract's balance. As a result, the total value calculation will include these tokens, which were not properly tracked by the contract.

3. Loss of Precision: The calculation of the total value involves dividing by token prices (prices.indexTokenPrice.min and prices.shortTokenPrice.min), which could cause a loss of precision, especially when dealing with large or small token amounts. This is further complicated by using balanceOf, which may not give an accurate snapshot when direct transfers are involved.

Impact

• Incorrect Total Value Calculation: The reliance on balanceOf(address(this)) can lead to inaccurate calculations of the vault’s total value, especially when external users send tokens directly to the contract. This miscalculation could lead to incorrect liquidation thresholds, mispricing, or unfair reward distribution.

• Potential Exploitation: Malicious actors could manipulate the contract's total value calculation by sending tokens directly to the contract, influencing important logic such as liquidations or reward distributions.

Tools Used

Manual code review.

Recommendations

• Instead of relying on balanceOf(address(this)), maintain state variables such as indexTokenBalance and collateralTokenBalance to track the contract’s token balances. Update these variables directly when tokens are transferred in or out of the contract.

• Modify the _totalAmount function to use the internal state variables for indexTokenBalance and collateralTokenBalance instead of relying on balanceOf(address(this)). This ensures that the total value calculation always reflects the correct, updated state.