Root + Impact

Description

• The protocol uses 1inch swaps to convert borrowed assets into collateral assets during leverage creation.

• The _executeOpenOperation function validates the swap return amount by checking the balance of the sold token instead of the purchased token, guaranteeing a validation failure.

Risk

Likelihood:

• The 1inch swap adapter consistently returns no data for many routes, triggering the fallback balance check.

• Use of the wrong token address guarantees the balance check reads zero.

Impact:

• New leveraged positions cannot be opened, causing a denial of service.

• Transactions revert due to incorrect slippage checks.

Proof of Concept

The following test case simulates the failure by mocking the router to return no data (a common behavior) and asserting that the transaction reverts. It highlights that the createLeveragedPosition function incorrectly checks the balance of address(usdc) (borrow token) instead of address(weth) (collateral token). Since the borrow token was sold, its balance is checked as 0, which fails the minReturnAmount check.

Recommended Mitigation

Pass the correct asset address (_asset, which represents the collateral token in this context) to the _call1InchSwap function. This ensures that the balance check verifies the amount of collateral purchased, correctly validating the swap result and slippage protection.