# Risk parameters should include additional checks to prevent mistakes Low/Info · Three Sigma · Hybrid orderbook DEX · 3rd April 2024 Finding 3S-Vertex-L06 of the Vertex security review. - Report: /reports/vertex - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-04-03-vertex.pdf --- ### Description Risk parameters should be lower, higher or equal to 1e18, depending if short or long. For example, the long risk values should be smaller or equal to 1e18, or some of the functionality may get corrupted. In SpotEngine::decomposeLps(), [rewards](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/main/contracts/SpotEngineLP.sol#L175-L182) are calculated as amountQuote * (1e18 - short/longMaintenanceWeight). amountQuote is expected to be a positive value, thus the selected weight will be long. Thus, if longWeightMaintenanceX18 > 1e18, rewards will be negative and the liquidatee earns these rewards. ### Recommendation Place explicit checks when [setting](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/main/contracts/BaseEngine.sol#L260) the risk parameters in BaseEngine::_addProductForId() . ### Status Addressed in [#38bbe76](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/commit/38bbe768d64139b9de91a065f4bdd1cb1e212198). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Bad check in `Vesting.sol::_resetVestingPlans` will prevent users from adding additional liquidity in `SymmVesting.sol`](https://0xsimao.com/findings/symmio-staking-and-vesting-vesting-plans-additional-symm): Symmio, Staking and Vesting - [NatSpect comments should include explanations of parameters and return variables](https://0xsimao.com/findings/glacier-nat-spect-comments-explanations): Glacier - [In function mint() and lzReceive(), _safeMint() is recommended over _mint(), which performs additional checks](https://0xsimao.com/findings/metazero-i-mint-recommended-performs-additional): MetaZero Omnichain NFTs