search

sherlock-audit / 2023-12-flatmoney-judging

11 stars 9 forks source link

petro1912 - In the worst case, the `settleFundingFees` function may not set `marginDepositedTotal` correctly, causing all functionality to break. #112

Closed sherlock-admin2 closed 8 months ago

sherlock-admin2 commented 8 months ago

petro1912

high

In the worst case, the settleFundingFees function may not set marginDepositedTotal correctly, causing all functionality to break.

Summary

In the worst case scenario where marginDepositedTotal is not enough for _fundingFees needed for longs to pay shorts, settleFundingFees() will return and all functionality of the protocol will be crashed.

Vulnerability Detail

There might be worst case scenario where marginDepositTotal is not enough for fundingFees. The documentation states that in this case 'marginDepositTotal' will be set to 0. However, calling this function will be reverted due to an invalid comparison in the implementation. In fact, marginDepositTotal is of type uint256 and is greater than all available negative fundingFees(int256), so the condition is always satisfied and in the worst case it is reverted. (marginDepositTotal < -fundingFees).

Impact

Announcement and execution of all leverage and liquidity function will call initially settleFundingFees function , so all the functionality will be broken in the worst case.

Code Snippet

https://github.com/sherlock-audit/2023-12-flatmoney/blob/main/flatcoin-v1/src/FlatcoinVault.sol#L232-L234

232:        _globalPositions.marginDepositedTotal = (int256(_globalPositions.marginDepositedTotal) > _fundingFees)
                ? uint256(int256(_globalPositions.marginDepositedTotal) + _fundingFees)
                : 0;

Tool used

Manual Review

Recommendation

-        _globalPositions.marginDepositedTotal = (int256(_globalPositions.marginDepositedTotal) > _fundingFees)
+        _globalPositions.marginDepositedTotal = (int256(_globalPositions.marginDepositedTotal) > -_fundingFees)
            ? uint256(int256(_globalPositions.marginDepositedTotal) + _fundingFees)
            : 0;

Duplicate of #195

sherlock-admin commented 8 months ago

1 comment(s) were left on this issue during the judging contest.

takarez commented:

valid: high(2)