search

code-423n4 / 2021-06-tracer-findings

1 stars 0 forks source link

Margin value is not checked to be non-negative in `leveragedNotionalValue` #141

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

The leveragedNotionalValue function of LibBalance gets the margin value of a position (i.e., the marginValue variable) to calculate the notional value. However, the position's margin value is not checked to be non-negative. Margin with a value less than zero is considered invalid and should be specially handled.

Proof of Concept

Referenced code: LibBalances.sol#L80

Recommended Mitigation Steps

Check whether marginValue is less than zero and handle this case.

OsmanBran commented 3 years ago

Although in a normal state marginValue should not be negative (due to being liquidated prior to this), this function should still handle negative values for marginValue and result in valid calculations. Reverting the function due to negative margin values will cause undesirable side-effects in the system.