Tracer contest - a_delamo's results

Handle

a_delamo

Vulnerability details

Impact

The method executeTrade on Trader.sol is calling matchOrders method of the TracerPerpetualSwaps contract. executeTrade is validating that the call was successful, but is missing to validate the return result == true. As a result, we will be adding invalid trade.

            (bool success, ) = makeOrder.market.call(
                abi.encodePacked(
                    ITracerPerpetualSwaps(makeOrder.market).matchOrders.selector,
                    abi.encode(makeOrder, takeOrder, fillAmount)
                )
            );

            // ignore orders that cannot be executed
            //FIXME: We should also check if return == false
            if (!success) continue;

            // update order state
            filled[makerOrderId] = makeOrderFilled + fillAmount;
            filled[takerOrderId] = takeOrderFilled + fillAmount;
            averageExecutionPrice[makerOrderId] = newMakeAverage;
            averageExecutionPrice[takerOrderId] = newTakeAverage;

                ....
                // validate orders can match, and outcome state is valid
		if (
			!Perpetuals.canMatch(order1, filled1, order2, filled2) ||
			!Balances.marginIsValid(
				newPos1,
				balances[order1.maker].lastUpdatedGasPrice *
					LIQUIDATION_GAS_COST,
				pricingContract.fairPrice(),
				trueMaxLeverage()
			) ||
			!Balances.marginIsValid(
				newPos2,
				balances[order2.maker].lastUpdatedGasPrice *
					LIQUIDATION_GAS_COST,
				pricingContract.fairPrice(),
				trueMaxLeverage()
			)
		) {
			// emit failed to match event and return false
			if (order1.side == Perpetuals.Side.Long) {
				emit FailedOrders(
					order1.maker,
					order2.maker,
					order1Id,
					order2Id
				);
			} else {
				emit FailedOrders(
					order2.maker,
					order1.maker,
					order2Id,
					order1Id
				);
			}
			return false;
		}
                ....

Handle

a_delamo

Vulnerability details

Impact

For every new TracerPerpetualSwaps contract, we need to deploy a new Liquidation, Insurance, and Pricing contract. All these deployments are really gas-intensive, so it would be recommended to use EIP-1167: Minimal Proxy Contract to reduce the gas cost of the deployments.

function _deployTracer(
        bytes calldata _data,
        address tracerOwner,
        address oracle,
        address fastGasOracle,
        uint256 maxLiquidationSlippage
    ) internal returns (address) {
        // Create and link tracer to factory
        address market = IPerpsDeployer(perpsDeployer).deploy(_data);
        ITracerPerpetualSwaps tracer = ITracerPerpetualSwaps(market);

        validTracers[market] = true;
        tracersByIndex[tracerCounter] = market;
        tracerCounter++;

        // Instantiate Insurance contract for tracer
        address insurance = IInsuranceDeployer(insuranceDeployer).deploy(market);
        address pricing = IPricingDeployer(pricingDeployer).deploy(market, insurance, oracle);
        address liquidation = ILiquidationDeployer(liquidationDeployer).deploy(
            pricing,
            market,
            insurance,
            fastGasOracle,
            maxLiquidationSlippage
        );

        // Perform admin operations on the tracer to finalise linking
        tracer.setInsuranceContract(insurance);
        tracer.setPricingContract(pricing);
        tracer.setLiquidationContract(liquidation);

        // Ownership either to the deployer or the DAO
        tracer.transferOwnership(tracerOwner);
        ILiquidation(liquidation).transferOwnership(tracerOwner);
        emit TracerDeployed(tracer.marketId(), address(tracer));
        return market;
    }

More info: https://blog.openzeppelin.com/deep-dive-into-the-minimal-proxy-contract/ https://eips.ethereum.org/EIPS/eip-1167