When the market is negative fluctuations, the rate of token would be less. Syncing suring this time would lead to settling the collateral and positions with less values
Impact
This would hurt the user balance when the market is in negative fluctuations.
ak1
medium
BalancedVault.sol#L137 :
sync()
can be called by anyone which would hurt the user when the market has negative fluctuations.Summary
function sync() is public and can be called by anyone.
This call will do the following actions, rebalance the maker and taker positions and settle the account.
Since the account would be zero address when the sync function is called, it will not cause any issue for account related operations.
But, since the
_rebalance
is called during the sync process, the_rebalance
do the rebalance for collateral as well as for position.This would be updating the positions and collateral values unnecessarily.
Vulnerability Detail
sync- can be called by anyone.
when we look at the _rebalance function , it will update the collateral and posittion.
When the market is negative fluctuations, the rate of token would be less. Syncing suring this time would lead to settling the collateral and positions with less values
Impact
This would hurt the user balance when the market is in negative fluctuations.
Code Snippet
https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-vaults/contracts/balanced/BalancedVault.sol#L137-L139
https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-vaults/contracts/balanced/BalancedVault.sol#L431-L434
https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-vaults/contracts/balanced/BalancedVault.sol#L440-L492
Tool used
Manual Review
Recommendation
Add modifier so that only the keeper would call this function or check valid account is calling.