Polynomial Protocol contest - carlitox477's results

Lines of code

https://github.com/code-423n4/2023-03-polynomial/blob/aeecafc8aaceab1ebeb94117459946032ccdff1e/src/Exchange.sol#L196 https://github.com/code-423n4/2023-03-polynomial/blob/aeecafc8aaceab1ebeb94117459946032ccdff1e/src/Exchange.sol#L416

Vulnerability details

Description

wad operations are meant to be done with int/uint which represent numbers with 18 decimals.

While the funding rate follows this representation, a simple time difference does not.

In Exchange.getMarkPrice as well as in Exchange._updateFundingRate a wadMul operation is done to multiply the funding rate per second by a simple time difference, leading to wrong calculation of normalizationFactor and mark price, affecting critical parts of the protocol

POC

In Exchange.getMarkPrice first we get the funding rate per second:

(int256 fundingRate,) = getFundingRate();
fundingRate = fundingRate / 1 days; // Funding rate per second

Immediately after, the total funding since last update is calculated:

int256 currentTimeStamp = int256(block.timestamp);
        int256 fundingLastUpdatedTimestamp = int256(fundingLastUpdated);

        // @audit funding rate X (time interval) / 1e18 = Number without decimal
        int256 totalFunding = wadMul(fundingRate, (currentTimeStamp - fundingLastUpdatedTimestamp));

int256 totalFunding = wadMul(fundingRate, (currentTimeStamp - fundingLastUpdatedTimestamp)); is the same that $TOTAL_ FUNDING_{t_{1}; t_{2}} = \frac{FUNDING_ RATE_{sec} \times (t_{2} - t_{1})}{10^{18}}$

However, the division by $10^{18}$ should not happen, given that time difference does not represent a number with 18 decimals.

This ends up in a miscalculation of totalFunding variable, and as a consequence, a miscalculation of mark price

The same issue happens in _updateFundingRate function

Impact

Here a complete list of function affected by this bug:

1. Exchange._updateFundingRate
   1. Exchange.openTrade
   2. Exchange.closeTrade
   3. Exchange.addCollateral
   4. Exchange.removeCollateral
   5. Exchange.liquidate
2. Exchange.getMarkPrice:
   1. Exchange._addCollateral
   2. Exchange._removeCollateral
   3. KangarooVault.getTokenPrice
   4. ShortCollateral.liquidate
   5. ShortCollateral.getMinCollateral
   6. ShortCollateral.canLiquidate
   7. ShortCollateral.maxLiquidatableDebt
   8. LiquidityPool.orderFee
   9. LiquidityPool.getMarkPrice
      1. LiquidityPool.getTokenPrice
      2. LiquidityPool.openLong
      3. LiquidityPool.closeLong
      4. LiquidityPool.openShort
      5. LiquidityPool.closeShort
      6. LiquidityPool.liquidate
      7. KangarooVault.removeCollateral
      8. KangarooVault._openPosition

As it can be seen, this bug affects multiple critical part of the protocol, calculating the correct mark price as well as updating the funding rate is essential for the protocol correct behavior.

Mitigation steps

Simply replace current wad operation for a simple multiplication

    function getMarkPrice() public view override returns (uint256 markPrice, bool isInvalid) {
        // Get base asset price from oracles
        (uint256 baseAssetPrice, bool invalid) = pool.baseAssetPrice();
        isInvalid = invalid;

        // Get funding rate per second
        // max 1% or 1e16
        (int256 fundingRate,) = getFundingRate();
        fundingRate = fundingRate / 1 days;

        int256 currentTimeStamp = int256(block.timestamp);
        int256 fundingLastUpdatedTimestamp = int256(fundingLastUpdated);

-       int256 totalFunding = wadMul(fundingRate, (currentTimeStamp - fundingLastUpdatedTimestamp));
+       int256 totalFunding = fundingRate, (currentTimeStamp - fundingLastUpdatedTimestamp);
        int256 normalizationUpdate = 1e18 - totalFunding;
        uint256 newNormalizationFactor = normalizationFactor.mulWadDown(uint256(normalizationUpdate));

        uint256 squarePrice = baseAssetPrice.mulDivDown(baseAssetPrice, PRICING_CONSTANT);
        markPrice = squarePrice.mulWadDown(newNormalizationFactor);
    }

    function _updateFundingRate() internal {
        (int256 fundingRate,) = getFundingRate();
        
        fundingRate = fundingRate / 1 days;

        int256 currentTimeStamp = int256(block.timestamp);
        int256 fundingLastUpdatedTimestamp = int256(fundingLastUpdated);

-       int256 totalFunding = wadMul(fundingRate, (currentTimeStamp - fundingLastUpdatedTimestamp));
+       int256 totalFunding = fundingRate, (currentTimeStamp - fundingLastUpdatedTimestamp);        

        int256 normalizationUpdate = 1e18 - totalFunding;

        normalizationFactor = normalizationFactor.mulWadDown(uint256(normalizationUpdate));
        
        emit UpdateFundingRate(fundingLastUpdated, normalizationFactor);
        fundingLastUpdated = block.timestamp;
    }