Closed c4-bot-5 closed 4 months ago
Picodes marked the issue as primary issue
realizedPremia may be stored in a signed container, but it cannot actually become negative in any situation
Picodes marked the issue as unsatisfactory: Insufficient proof
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L1650-L1652 https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L473 https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L1892
Vulnerability details
Impact
The
PanopticPool.settleLongPremium
function is used to settle all unpaid premium forlong legs
ontokenIds
ofowners
. In the function exeuction of thePanopticPool.settleLongPremium
, therealizedPremia
is deducted from theowner's balance
and then added to the cumulative settled token delta as shown below:But the issue here is that the
LeftRightSigned.unwrap(realizedPremia)
value which is aint256
is converted into auint256
unsafely and then added onto thes_settledTokens[chunkKey]
storage. Since theint256
holds negative values intwo's complement format
, unsafe casting of a negativeLeftRightSigned.unwrap(realizedPremia)
value to auint256
will result in a large positive value.Hence this will add a large value to the
s_settledTokens[chunkKey]
(where as it should reduce by that value since the value is negative) thus breaking the state of thes_settledTokens
mapping. As a result the amount of tokens owed to sellers that have been settled for that specific chunk is now errorneous.Since the
s_settledTokens[chunkKey]
storage value is broken, the critical functions such as_calculateAccumulatedPremia
,liquidate
,_updateSettlementPostMint
and_updateSettlementPostBurn
will also prompt into undesirable state. Since this errorneouss_settledTokens
value is used in the_calculateAccumulatedPremia
function to calculate theportfolioPremium
value, and this value is used as thepremia
value to calculate the margin requirement in thePanopticPool.liquidate
function by calling theCollateralTracker.getAccountMarginDetails
, this could result in errorneous values forbalanceCross
andthresholdCross
. Due to these errorneous values the positions which are not liquidatable could appear as liquidatable positions and vice versa. If positions which are liqudatable can not be liquidated as a result of the above vulnerability this could prompt the Panoptic protocol into insolvency.Similar issue of errorneous casting of
LeftRightSigned.unwrap(realizedPremia)
to auint256
are found in thePanopticPool._calculateAccumulatedPremia
andPanopticPool._updateSettlementPostBurn
functions as well.Proof of Concept
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L1650-L1652
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L473
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L1892
Tools Used
Manual Review and VSCode
Recommended Mitigation Steps
Hence it is recommended to conduct safe casting of
LeftRightSigned.unwrap(realizedPremia)
value ofint256
to auint256
. Hence if theLeftRightSigned.unwrap(realizedPremia)
value is negative then it can be converted into a positive value before adding onto thes_settledTokens[chunkKey]
state.Assessed type
Other