Open code423n4 opened 1 year ago
JustDravee marked the issue as primary issue
rivalq marked the issue as disagree with severity
JustDravee changed the severity to QA (Quality Assurance)
Would like @rivalq 's thought on the severity and validity. Was there a reason for an absence on these checks? (Like a redundancy because it would revert somewhere on an invalid price).
It was also raised by the warden that an invalid price could be 0 through these links:
This seems like a miss from our side.
mubaris marked the issue as sponsor confirmed
This previously downgraded issue has been upgraded by JustDravee
Agreed on Medium severity
JustDravee marked the issue as selected for report
Lines of code
https://github.com/code-423n4/2023-03-polynomial/blob/main/src/ShortCollateral.sol#L133-L134 https://github.com/code-423n4/2023-03-polynomial/blob/main/src/LiquidityPool.sol#L388
Vulnerability details
Impact
Lack of a validity check while liquidating results in loss of funds, as the price could be invalid momentarily from Synthetix due to high volatility or other issues.
Proof of Concept
There isn't a check for
isInvalid
ingetMarkPrice
andgetAssetPrice
, which must be false before closing the liquidation:This check is used in other similar functions that fetch the price:
This must be present to ensure that the price fetched from Synthetix is not stale or invalid.
If this isn't the case, a liquidation could result in under-liquidation (a loss for the user) or over-liquidation (a loss for the protocol).
The same problem is also present in
LiquidityPool
:As the
markPrice
is not validated when calculating theorderFee
.Tools Used
Manual review
Recommended Mitigation Steps
Add a check to be sure that
isInvalid
is false in bothmarkPrice
andcollateralPrice
before liquidating.