Skip to content
Request an audit

‹ All findings

Risk parameters should include additional checks to prevent mistakes

Low/InfoVertex·by the Three Sigma team·Hybrid orderbook DEX·3rd April 20243S-Vertex-L06

Report PageSource

Description

Risk parameters should be lower, higher or equal to 1e18, depending if short or long. For example, the long risk values should be smaller or equal to 1e18, or some of the functionality may get corrupted.

In SpotEngine::decomposeLps(), rewards are calculated as amountQuote * (1e18 - short/longMaintenanceWeight). amountQuote is expected to be a positive value, thus the selected weight will be long.

Thus, if longWeightMaintenanceX18 > 1e18, rewards will be negative and the liquidatee earns these rewards.

Recommendation

Place explicit checks when setting the risk parameters in BaseEngine::_addProductForId() .

Status

Addressed in #38bbe76.

Found during Three Sigma’s team review · 0xSimao on the review team