Liquidity Management

PerpetualVault.sol

Observation:
The variable flowData is used to store different types of information depending on the current flow:

• In a withdrawal flow, it is set to the deposit ID:

  flowData = depositId;

  ​

• In the deposit flow (during MarketIncrease orders) it temporarily holds “previous size in tokens.”

• In the liquidation branch, it is overwritten with the current position size.

Later, functions like _handleReturn decode flowData as a deposit ID:

Risk:
Because the same storage slot is used for different meanings across flows, an attacker (or a malicious keeper) may be able to force a state transition or manipulate the value of flowData between flows. This could cause, for example, a withdrawal to reference the wrong deposit record, potentially allowing an attacker to withdraw funds they are not entitled to or to disrupt the fair distribution of shares.

Recommendation:
Separate the flow‐related data into distinct variables (or use a struct with clearly typed fields) so that each piece of information is stored in its proper context. This eliminates the risk of type confusion and unintended overwrites between flows.