084.md

Festive Mint Platypus

High

LMSR invariant does not hold on simulateBuy

Summary

The invariant described in the code states that the price of trust vote and the distrust vote must always sum up to the market's base price. While this is taken care of in the getVotePrice function, it's not the function used when actually simulating buy and sell. Therefore, the invariant doesn't hold on the simulated funds paid.

PoC

Add the following test in rep.market.test.ts

  describe('POC: LMSR invariant breaks on simulation', () => {
    it('POC', async () => {

      // Please NOTE: protocolfee and donation is 0 in this example
      // Vreifiable by console.log() the tuple values inside the simulateBuy method

      const market = await reputationMarket.getMarket(DEFAULT.profileId);

      // Price of 1 TRUST vote
      const trustVotePrice = await reputationMarket.getVotePrice(
        DEFAULT.profileId,
        true,
      );

      // Simulated price of 1 TRUST vote
      const { simulatedFundsPaid: simulatedTrustVotePrice } = await userA.simulateBuy({
        buyAmount: DEFAULT.buyAmount * 100n,
        votesToBuy: 1n,
        isPositive: true,
      });

      // Price of 1 DISTRUST vote
      const distrustVotePrice = await reputationMarket.getVotePrice(
        DEFAULT.profileId,
        false,
      );

      // Simulated price of 1 DISTRUST vote
      const { simulatedFundsPaid: simulateDistrustVotePrice } = await userA.simulateBuy({
        buyAmount: DEFAULT.buyAmount * 100n,
        votesToBuy: 1n,
        isPositive: false,
      });

      expect(simulatedTrustVotePrice).to.not.equal(trustVotePrice);
      expect(simulateDistrustVotePrice).to.not.eq(distrustVotePrice);

      // Sum total of trust price and distrust price is equal to base price as per the `getVotePrice` which is expected
      expect(trustVotePrice + distrustVotePrice).to.be.equal(market.basePrice);

      // Now, let's see where I think the problem is ..

      // NOTE: Here, even though there is 0 protocol fee and  0 donation fee,
      // the sum total of trust and distrust price does not equal base price when it comes to funds being paid at a given
      // point in time.
      expect(simulateDistrustVotePrice + simulatedTrustVotePrice).to.be.greaterThan(market.basePrice);

    });
  });

Mitigation

No response