Stratax Contracts

Description

The view helper calculateUnwindParams() computes collateralToWithdraw using a simple price-ratio formula plus a hardcoded 5% buffer. But _executeUnwindOperation() internally recalculates its own collateralToWithdraw using Aave's liquidation threshold. These two formulas produce different values.

Route Cause

calculateUnwindParams():

_executeUnwindOperation():

The execution function ignores the collateralToWithdraw parameter passed in from unwindPosition() and recomputes it internally. So the value from calculateUnwindParams() is used only to generate the 1inch swap calldata off-chain — but the actual withdrawal amount differs. The swap calldata is built for the wrong amount.

Impact

The 1inch swap calldata is generated for collateral amount X, but the contract withdraws amount Y. If Y > X, the swap receives more collateral than expected and likely has leftover. If Y < X, the swap doesn't receive enough input and reverts or produces insufficient debt tokens to repay the flash loan, bricking the unwind.

Proof of Concept

Recommended Mitigation

Pick one formula and use it in both places, or pass collateralToWithdraw into the execution function and use it directly instead of recalculating: