aslanbek - Actual funding can be lower than intended due to precision loss in utilization

[sherlock-admin4]

aslanbek

Medium

Actual funding can be lower than intended due to precision loss in utilization

Summary

Because params#utilization is not multiplied by a precision factor, computed utilization can be up to 100% lower than the actual one (i.e. 0 instead of ~1), which in turn would make funding fees up to 100% lower than intended.

Root Cause

Absense of precision factor in params#utilization (and absence of division by the same factor in params#scale).

Impact

Shorts/longs receive up to 100% less funding fees from longs/shorts than they should.

PoC

base_reserves = 101e18
base_interest = 1e18
utilization = 1e18 / (101e18 / 100) = 1e18 / 1.01e18 = 0

Mitigation

utilization should be multiplied by 1e18 (or another suitable precision factor).
scale should be divided by the same value.

Duplicate of #72

[aslanbekaibimov]

Escalate

Valid Medium

Causes a loss of funds but requires certain external conditions or specific states, or a loss is highly constrained. The losses must exceed small, finite amount of funds, and any amount relevant based on the precision or significance of the loss.

[sherlock-admin3]

Escalate

Valid Medium

Causes a loss of funds but requires certain external conditions or specific states, or a loss is highly constrained. The losses must exceed small, finite amount of funds, and any amount relevant based on the precision or significance of the loss.

You've created a valid escalation!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[WangSecurity]

@aslanbekaibimov could you make a scenario showcasing how the utilisation can be so low?

[aslanbekaibimov]

Let's say we have ETH/USDT pair, 1 ETH = 2000 USDT

base_reserves == 101e18 from the report can happen if someone deposits 101e18 ETH

base_interest == 1e18 from the report can happen if someone opens a relatively small long position

E.g. LP Alice provides 101e18 ETH and 202_000e6 USDT via mint (1e18 ETH = 2000e6 USDT)

Trader Bob opens a long of 0.5e18 ETH with 2000e6 USDT of collateral without leverage

base_interest = interest.base = position.interest_tagged.base = interest = virtual_tokens * leverage = quote_to_base(2000 USDT to ETH) = 1e18

[WangSecurity]

Thank you for that numerical POC. The issue is correct and indeed identifies a precision loss leading to a loss of funds. Planning to accept the escalation and validate with medium severity. This issue will be duplicated with #72, since #72 has the POC in the report.

[WangSecurity]

Result:
Medium
Duplicate of #72

[sherlock-admin3]

Escalations have been resolved successfully!

Escalation status:

• aslanbekaibimov: accepted