Overlay Protocol contest - gzeon's results

Handle

gzeon

Vulnerability details

Proof of Concept

We don't need full 256 bit if leverage is discrete amount, can pack this into a uint8 so that the first 3 variable in Position.Info struct pack into 1 storage slot instead of 2.

https://github.com/code-423n4/2021-11-overlay/blob/1833b792caf3eb8756b1ba5f50f9c2ce085e54d0/contracts/libraries/Position.sol#L14

Recommended Mitigation Steps

    struct Info {
        address market; // the market for the position
        bool isLong; // whether long or short
        uint8 leverage; // discrete initial leverage amount
        uint pricePoint; // pricePointIndex
        uint256 oiShares; // shares of total open interest on long/short side, depending on isLong value
        uint256 debt; // total debt associated with this position
        uint256 cost; // total amount of collateral initially locked; effectively, cost to enter position
    }

with casting whenever leverage variable is used

Handle

gzeon

Vulnerability details

Proof of Concept

https://github.com/code-423n4/2021-11-overlay/blob/1833b792caf3eb8756b1ba5f50f9c2ce085e54d0/contracts/mothership/OverlayV1Mothership.sol#L10

L10-L14