004.md

Lucky Peach Barbel

Medium

Premature Fee Deduction in next.collateral Update Leads to Incorrect Collateral Calculations

In the accumulate() function of CheckpointLib,the next.collateral calculation prematurely subtracts settlement and trade fees from the latest checkpoint’s collateral before incorporating new collateral changes, price overrides, and other adjustments. Specifically, the code snippet below deducts tradeFee and settlementFee early in the calculation:

next.collateral = settlementContext.latestCheckpoint.collateral
    .sub(settlementContext.latestCheckpoint.tradeFee)
    .sub(Fixed6Lib.from(settlementContext.latestCheckpoint.settlementFee));

This approach assumes that all fees are finalized and processed, which may not hold true if there are pending updates or deferred fee calculations in the toVersion. As a result, when the function subsequently adds the new collateral changes and price overrides (result.collateral and result.priceOverride), it can either double-deduct fees that are recomputed later or produce incorrect final values for next.collateral. This discrepancy creates potential inaccuracies in collateral tracking, particularly during edge cases involving concurrent settlement and collateral adjustments.

Impact:

The primary impact of this bug is under-collateralization, where the system misrepresents available collateral due to redundant or incomplete fee deductions, which can lead to insolvency or liquidation errors.

Mitigation:

Reorder the calculation of next.collateral so that settlement and trade fees are subtracted only after adding all new collateral, price override, and other adjustments.