bughuntoor - If position goes to 0, the funding fees it should've received are never redistributed and are forever stuck

[sherlock-admin4]

bughuntoor

Medium

If position goes to 0, the funding fees it should've received are never redistributed and are forever stuck

Summary

If position goes to 0, the funding fees it should've received are never redistributed and are forever stuck

Vulnerability Detail

If a user position's collateral goes to 0, the user loses all of it, including any funding fees they should've received

  # 1) we penalize negative positions by setting their funding_received to zero
  funding_received: uint256       = 0 if remaining == 0 else (
    # 2) funding_received may add up to more than available collateral, and
    #    we will pay funding fees out on a first come first serve basis
                                    min(fees.funding_received, avail) )

However, the problem is that the amount they should've received is later not subtracted from the collateral and will remain permanently stuck.

For this reason, we can see that FeesPaid has a funding_received_want arg which is intended to be used for that exact reason but is actually never used.

Impact

Loss of funds

Code Snippet

https://github.com/sherlock-audit/2024-08-velar-artha/blob/main/gl-sherlock/contracts/positions.vy#L268

Tool used

Manual Review

Recommendation

Use the intended funding_received_want and subtract it from the collateral so it is not stuck and instead redistributed to LP providers

Duplicate of #83

[spacegliderrrr]

Escalate

Issue should be a dup of #18. However, sponsor comments must be taken into account:

this is intentional, if you read through the worst case scenario, skimming fees and keeping them in the collateral pool works as a kind of emergent insurance fund (obv both this and the worst case scenario are extremely unlikely to actually happen since liq bots would have to be down at just thw wrong time for quite a while)

Will leave at HoJ discretion whether this should be low.

[sherlock-admin3]

Escalate

Issue should be a dup of #18. However, sponsor comments must be taken into account:

this is intentional, if you read through the worst case scenario, skimming fees and keeping them in the collateral pool works as a kind of emergent insurance fund (obv both this and the worst case scenario are extremely unlikely to actually happen since liq bots would have to be down at just thw wrong time for quite a while)

Will leave at HoJ discretion whether this should be low.

You've created a valid escalation!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[ami0x226]

This issue should be low. The position should be liquidated before collateral becomes zero by liquidation bot like #18

[WangSecurity]

This is indeed a duplicate of #18, but #18 is escalated. Hence, if #18 is in the end invalid, then this escalation will be rejected. If #18 is in the end valid, then this escalation will be accepted and the issue duplicated with #18.

The main discussion will remain on #18.

[rickkk137]

also #83

[WangSecurity]

Result:
Invalid
Unique

[sherlock-admin4]

Escalations have been resolved successfully!

Escalation status:

• spacegliderrrr: rejected

[WangSecurity]

This issue is duplicated with #83, look into this comment for details #83 (comment)