Closed sherlock-admin3 closed 5 months ago
2 comment(s) were left on this issue during the judging contest.
panprog commented:
valid medium, dup of #16
takarez commented:
valid; medium(2)
The protocol team fixed this issue in the following PRs/commits: https://github.com/equilibria-xyz/perennial-v2/pull/302
The Lead Senior Watson signed off on the fix.
bin2chen
medium
Liquidator/referrer is himself, rewards will be lost
Summary
The current protocol does not restrict the user from liquidating themselves or the referrer from setting it up as themselves If they are themselves, the current logic means that this part of the reward will be lost.
Vulnerability Detail
When execute
_processOrderLocal()
will give the liquidate fee and referral fee to the appropriate person.The
_credit()
method readsclaimable
from storage and saves it to storage.This will cause
claimable
to be overwritten ifliquidators[account][newOrderId]
orreferrers[account][newOrderId]
is the account of the current pendingOrder.Assumptions: alice refers itself, or liquidates itself liquidators[account][orderId] = alice referrers[account][orderId] = alice
Executing settle(alice), would look like this:
Impact
The liquidator/referrer is himself, the reward will be lost and locked in the contract
Code Snippet
https://github.com/sherlock-audit/2024-02-perennial-v2-3/blob/main/perennial-v2/packages/perennial/contracts/Market.sol#L668-L669
Tool used
Manual Review
Recommendation
Duplicate of #16