009.md

Lucky Peach Barbel

Medium

Users attempting to fully close their positions may find their positions still open due to Incorrect Handling of MAGIC_VALUE_FULLY_CLOSED_POSITION

The _processPositionMagicValue function in MagicValueLib incorrectly handles the MAGIC_VALUE_FULLY_CLOSED_POSITION magic value. When context.pendingLocal.crossesZero() returns true, the function returns the currentPosition without reducing it, even though the intent of MAGIC_VALUE_FULLY_CLOSED_POSITION is to fully close the position. This occurs because the function prioritizes the zero-crossing check over the intended action of closing the position. Specifically, the code snippet below shows the flawed logic:

if (newPosition.eq(MAGIC_VALUE_FULLY_CLOSED_POSITION)) {
    if (context.pendingLocal.crossesZero()) return currentPosition; // @audit Ignores fully close intent
    return context.pendingLocal.pos().min(currentPosition);
}

This logic fails to ensure that the position is fully closed when crossesZero() is true, this inconsistency can lead to unexpected behavior where the position remains open despite the user's request to close it.

Impact:

Users attempting to fully close their positions may find their positions still open, leading to unintended exposure to market risks or financial losses due to unexpected margin calls or liquidation.

Mitigation:

Ensure that MAGIC_VALUE_FULLY_CLOSED_POSITION always results in a fully closed position by returning UFixed6Lib.ZERO unconditionally, regardless of crossesZero().