marginRequired in function _hedge includes the hedgingFees. Then usedFunds is updated correctly in function _hedge, that it increases the amount of SUSD tokens which is sent to PerpMarket.
In function openLong, the pool claims totalCost of SUSD tokens from user. And it only transfer externalFee outside of contract. Then usedFunds should be updated in function openLong as the following:
usedFunds -= int256(totalCost) - externalFee;
Similarly, all functions closeLong, openShort, closeShort and liquidate update usedFunds incorrectly. It shoule be updated as the following:
Function closeLong:
usedFunds += int256(totalCost) + externalFee;
Function openShort:
usedFunds += int256(totalCost) + externalFee;
Function closeShort:
usedFunds -= int256(totalCost) - externalFee;
Function liquidate:
remove usedFunds += int256(hedgingFees);
Tool used
Manual Review
Recommended Mitigation Steps
Should follow the above mitigation to fix the calculation of usedFunds
Lines of code
https://github.com/code-423n4/2023-03-polynomial/blob/main/src/LiquidityPool.sol#L452 https://github.com/code-423n4/2023-03-polynomial/blob/main/src/LiquidityPool.sol#L484 https://github.com/code-423n4/2023-03-polynomial/blob/main/src/LiquidityPool.sol#L516 https://github.com/code-423n4/2023-03-polynomial/blob/main/src/LiquidityPool.sol#L549 https://github.com/code-423n4/2023-03-polynomial/blob/main/src/LiquidityPool.sol#L562
Vulnerability details
Impact
usedFunds
of LiquidityPool is calculated incorrectlyProof of concept
usedFunds
tracks the funds utilitized from the pool. Let's see howusedFunds
is accumulated when opening a long position:usedFunds
is still updated in function_hedge
:marginRequired
in function_hedge
includes thehedgingFees
. ThenusedFunds
is updated correctly in function_hedge
, that it increases the amount of SUSD tokens which is sent to PerpMarket.openLong
, the pool claimstotalCost
of SUSD tokens from user. And it only transferexternalFee
outside of contract. ThenusedFunds
should be updated in functionopenLong
as the following:Similarly, all functions
closeLong
,openShort
,closeShort
andliquidate
updateusedFunds
incorrectly. It shoule be updated as the following:closeLong
:openShort
:closeShort
:liquidate
: removeusedFunds += int256(hedgingFees);
Tool used
Manual Review
Recommended Mitigation Steps
Should follow the above mitigation to fix the calculation of
usedFunds