Closed sherlock-admin3 closed 4 months ago
1 comment(s) were left on this issue during the judging contest.
panprog commented:
invalid, because it's quite possible for admin to atomically turn off settle only, commit oracle, turn on settle only, even if this exact set of actions is not described in the migration guide. This might be a sub-optimal behaviour for admin, but shouldn't prevent successful migration
request poc
PoC requested from @bin2chen66
Requests remaining: 2
@nevillehuang It does work if the administrator collects all the Oracle and commits it manually, although it's a bit of a hassle and slows down the migration time. thanks
@bin2chen66 Seems like low severity is more appropriate given there is a workaround without any loss correct?
In the real scenario, the protocol will not be migrated like this. It should be the way I suggest. But after this problem occurs, it is also possible to do so. Although it will not be done.
But it is OK from an audit impact perspective. I agree with low
The protocol team fixed this issue in the following PRs/commits: https://github.com/equilibria-xyz/perennial-v2/pull/310
The Lead Senior Watson signed off on the fix.
bin2chen
medium
after update v2.1.1 may not be able to settle properly
Summary
Updating
v2.1.1
will setsettleOnly=true
and settle all users. The latestOracleVersion
needs to be commited before settle. However, commit theOracleVersion
may triggermarket.update()
and prevent theOracleVersion
from being updated properly.Vulnerability Detail
An important step in updating v2.2 is to settle all users first.
settleOnly=true
-> will pause allmarket.update()
We need to wait for the latest
OracleVersion
before settle all users.But currently, updating the latest
OracleVersion
triggersmarket.update()
.market.update()
withsettleOnly=true
is not executableSo it can't update the latest
OracleVersion
, so it can't reallysettle
.It is recommended to use a method dedicated to settlement:
market.settle()
.Impact
If all settlements are not made before
settleOnly = true
, or if someone maliciously submits the order before executingsettleOnly = true
This could lead to not settle properly after updating v2.1.1Code Snippet
https://github.com/equilibria-xyz/perennial-v2/blob/22ba19c323a13c9f02f95db6747d137a3bf1277a/packages/perennial-oracle/contracts/keeper/KeeperOracle.sol#L179
Tool used
Manual Review
Recommendation