Dopex - clash's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/main/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L201

Vulnerability details

Impact

  function subtractLoss(uint256 loss) public onlyPerpVault {
    require(
      collateral.balanceOf(address(this)) == _totalCollateral - loss,
      "Not enough collateral was sent out"
    );
    _totalCollateral -= loss;
  }

If collateral token balance is not equal to _totalCollateral - loss, it will revert. _totalCollateral is a state variable that can be updated using deposit/withdraw or by vault. Parameter loss is calculated in PerpetualAtlanticVault::settle from options. These variables cannot be controlled directly and the protocol assumes collateral token balance of the contract strictly follows rules. Malicious actor can break the assumption and grieve the protocol.

Proof of Concept

Send at least 1 wei of collateral token to PerpetualAtlanticVaultLP contract and the PerpetualAtlanticVault::settle would be broken.

Tools Used

Manual

Recommended Mitigation Steps

Replace == with >= or <= as appropriate.

Assessed type

Token-Transfer