Function autoReducePositions will be always reverted because the price is not set.
Vulnerability Detail
Function autoReducePositions is one key part of the whole system risk control. When some positions win too much profit in some extreme market conditions, the keeper will close these positions to decrease the whole system's risk.
The vulnerability is that we lack setOraclePrice in the function autoReducePositions. And the tokens' price is necessary when we close some positions. So this autoReducePositions will be reverted because of PriceIsZero().
Error: VM Exception while processing transaction: reverted with custom error 'PriceIsZero()'
at OracleProcess._getLatestUsdPriceWithOracle (contracts/process/OracleProcess.sol:124)
at OracleProcess.getLatestUsdPrice (contracts/process/OracleProcess.sol:102)
at PositionFacet.autoReducePositions (contracts/facets/PositionFacet.sol:220)
at Diamond.<fallback> (contracts/router/Diamond.sol:61)
at processTicksAndRejections (node:internal/process/task_queues:95:5)
at async HardhatNode._mineBlockWithPendingTxs (node_modules/hardhat/src/internal/hardhat-network/provider/node.ts:1854:23)
at async HardhatNode.mineBlock (node_modules/hardhat/src/internal/hardhat-network/provider/node.ts:524:16)
at async EthModule._sendTransactionAndReturnHash (node_modules/hardhat/src/internal/hardhat-network/provider/modules/eth.ts:1546:18)
at async HardhatNetworkProvider.request (node_modules/hardhat/src/internal/hardhat-network/provider/provider.ts:124:18)
at async HardhatEthersSigner.sendTransaction (node_modules/@nomicfoundation/hardhat-ethers/src/signers.ts:125:18)
at async send (node_modules/ethers/src.ts/contract/contract.ts:299:20)
Impact
autoReducePositions is one key part of the whole system's risk control. If autoReducePositions does not work, the whole system need to face more risk in one extreme market condition. Although the keeper role can call OracleFacet::setOraclePrices and autoReducePositions in one transaction to avoid this revert, I've already confirmed with the sponsor, the keeper role will call autoReducePositions directly.
jennifer37
Medium
Lack of oracle setting in autoReducePositions
Summary
Function
autoReducePositions
will be always reverted because the price is not set.Vulnerability Detail
Function
autoReducePositions
is one key part of the whole system risk control. When some positions win too much profit in some extreme market conditions, the keeper will close these positions to decrease the whole system's risk.The vulnerability is that we lack
setOraclePrice
in the functionautoReducePositions
. And the tokens' price is necessary when we close some positions. So thisautoReducePositions
will be reverted because of PriceIsZero().Poc
autoReducePositions
will be reverted.Output
Impact
autoReducePositions
is one key part of the whole system's risk control. IfautoReducePositions
does not work, the whole system need to face more risk in one extreme market condition. Although the keeper role can callOracleFacet::setOraclePrices
andautoReducePositions
in one transaction to avoid this revert, I've already confirmed with the sponsor, the keeper role will callautoReducePositions
directly.Code Snippet
https://github.com/sherlock-audit/2024-05-elfi-protocol/blob/main/elfi-perp-contracts/contracts/facets/PositionFacet.sol#L196-L216
Tool used
Manual Review
Recommendation
Add
OracleProcess.setOraclePrice(oracles);
andOracleProcess.clearOraclePrice();
in functionautoReducePositions