is asking werc20 to burn the wrapped token (erc1155) to receive back the burnToken which is the SoftVault token. the received amount should stay on the SPELL to transfer by _doPutCollateral to werc20 again (the old + the new vault token ) in the next step.
But it transfers them to the user by invoking _doRefund(burnToken); with out updating pos.underlyingVaultShare
Impact
the transaction could end up successfully if the position has enough Isolated Collateral on the SoftVault but it will be in an awkward position
or the transaction will keep reverting in the isLiquidatable() check
Ch_301
high
ShortLongSpell.openPosition()
should not refund tokenSummary
Vulnerability Detail
this part of ShortLongSpell.openPosition()
is asking werc20 to burn the wrapped token (erc1155) to receive back the
burnToken
which is theSoftVault
token. the received amount should stay on the SPELL to transfer by_doPutCollateral
to werc20 again (the old + the new vault token ) in the next step.But it transfers them to the user by invoking _doRefund(burnToken); with out updating
pos.underlyingVaultShare
Impact
isLiquidatable()
checkCode Snippet
Tool used
Manual Review
Recommendation
Duplicate of #135