search

sherlock-audit / 2023-07-perennial-judging

2 stars 1 forks source link

feelereth - Updating market parameters like leverage could instantly liquidate positions #90

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

feelereth

high

Updating market parameters like leverage could instantly liquidate positions

Summary

There is a risk of instant liquidation when updating market parameters like leverage in the Vault contract. The issue occurs in the updateMarket() function

Vulnerability Detail

Here the market's leverage is directly set to a new value. If the newLeverage is drastically lower than the current leverage, it could put the Vault's position on that market underwater. For example:

  1. Vault has 1 ETH collateral on Market A
  2. Market A has 10x leverage, so Vault has 10 ETH in position
  3. Market A price is $1000, so Vault has $10,000 in position value
  4. Owner calls updateMarket to lower leverage to 5x
  5. Now Vault's 1 ETH collateral only supports 5 ETH position
  6. But Vault still has 10 ETH position open, this is now underwater 5 ETH
  7. Vault will get liquidated on next update call

Impact

It could put the Vault's position on that market underwater

Code Snippet

https://github.com/sherlock-audit/2023-07-perennial/blob/main/perennial-v2/packages/perennial-vault/contracts/Vault.sol#L157-L167 https://github.com/sherlock-audit/2023-07-perennial/blob/main/perennial-v2/packages/perennial-vault/contracts/Vault.sol#L164

Tool used

Manual Review

Recommendation

add a constraint to maximum leverage change

sherlock-admin commented 1 year ago

2 comment(s) were left on this issue during the judging contest.

141345 commented:

d

panprog commented:

invalid because owner is trusted and is assumed to know what he's doing, including change of leverage