Closed c4-bot-5 closed 4 months ago
Picodes marked the issue as primary issue
Liquidators will sometimes have to sell options as a last resort to complete a liquidation -- this was explained in the contest README: "It's expected that liquidators may have to sell options, perform force exercises, and deposit collateral to perform some liquidations. In some situations, the liquidation may not be profitable."
Picodes marked the issue as unsatisfactory: Out of scope
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L1086-L1092 https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/SemiFungiblePositionManager.sol#L1013-L1018
Vulnerability details
Impact
The
PanopticPool.liquidate
function is used toliquidate
adistressed account
by burning all the positions of aliquidatee
. In theliquidate
function thePanopticPool._burnAllOptionsFrom
internal function is called. In the execution flow of thePanopticPool._burnAllOptionsFrom
function theSemiFungiblePositionManager._createLegInAMM
function is called to create a the respective position in theAMM
for aspecific leg
in thetokenId
.In the
SemiFungiblePositionManager._createLegInAMM
function uses the following condition to check whether the respectiveposition
hasenough liquidity
in theUniswapV3Pool
to be removed for a respective long position. In the event of aliquidation
this check will be performed when closing ashort position
by creating along position
.The issue here is if a malicious user front-runs the
liquidation
transaction and create a considerablylarge long position
(within the same tick range of tickLower - tickUpper in the UniswapV3 pool) making thestartingLiquidity < chunkLiquidity
then the subsequent liquidation transaction will revert sincestartingLiquidity < chunkLiquidity
condition will result intrue
and theif statement
will revert.Hence the
liquidations
could revert as a result till more liquidity is added to thatliquidity position
in the respectiveUniswapV3Pool
. If theliquidations
can not be performed as a result of reverting due to above vulnerability, the entire panoptic protocol could become insolvent thus putting the user funds of thePLPs
and theoptions creators
in danger since they could lose the provided funds to the Panoptic protocol.Proof of Concept
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L1086-L1092
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/SemiFungiblePositionManager.sol#L1013-L1018
Tools Used
Manual Review and VSCode
Recommended Mitigation Steps
The
Panoptic Protocol
uses theliquidation bots
to identify liquidatable accounts. Hence if this liquidation bot can be developed to calculate the liquidity in thedistressed short positions
, then that value can be reduced from theavailable liquidity in the UniswapV3 pool
when creating thelong positions
(where liquidity will be removed). As a result a malicious user (could be liquidatee himself) will not be able to front-run aliquidation
transaction and remove liquidity from a position such that closing of the distressed position will revert due to not having enough liquidity in the position as explained above.Assessed type
DoS