KingNFT - ````_globalPositions.marginDepositedTotal```` might be set to a extreme big number

[sherlock-admin2]

KingNFT

medium

_globalPositions.marginDepositedTotal might be set to a extreme big number

Summary

There is a invalid validation before updating _globalPositions.marginDepositedTotal, it's value might be set to a extreme big number due to overflow. In this case, the protocol would be bricked.

Vulnerability Detail

The issue arise on L232 of FlatcoinVault.sol, the validation of int256(_globalPositions.marginDepositedTotal) > _fundingFees is invalid. let's say _globalPositions.marginDepositedTotal = 100 and _fundingFees = -101, they meet the above validation, but then uint256(int256(_globalPositions.marginDepositedTotal) + _fundingFees) = uint256(100 - 101) = uint256(-1) = type(uint256).max. Unintentional overflow occurs and _globalPositions.marginDepositedTotal is being set to a extreme big number.

File: src/FlatcoinVault.sol
232:         _globalPositions.marginDepositedTotal = (int256(_globalPositions.marginDepositedTotal) > _fundingFees)
233:             ? uint256(int256(_globalPositions.marginDepositedTotal) + _fundingFees)
234:             : 0;

Impact

In this case, any subsequent operations for increasing net global margin would fail, which includes openPosition, increasePositionMargin and updateGlobalPositionPnL.

Code Snippet

https://github.com/sherlock-audit/2023-12-flatmoney/blob/bba4f077a64f43fbd565f8983388d0e985cb85db/flatcoin-v1/src/FlatcoinVault.sol#L232

Tool used

Manual Review

Recommendation

File: src/FlatcoinVault.sol
-232:         _globalPositions.marginDepositedTotal = (int256(_globalPositions.marginDepositedTotal) > _fundingFees)
+232:         _globalPositions.marginDepositedTotal = (int256(_globalPositions.marginDepositedTotal) + _fundingFees > 0)
233:             ? uint256(int256(_globalPositions.marginDepositedTotal) + _fundingFees)
234:             : 0;

Duplicate of #195

[sherlock-admin]

1 comment(s) were left on this issue during the judging contest.

takarez commented:

valid; high(2)