Tigris Trade contest - jadezti's results

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/PairsContract.sol#L139-L143

Vulnerability details

Impact

The max open interest limit updating function setMaxOi didn't verify the new max open interest limit against existing long/short open interests. The consequence is that the existing assets' long/short open interests may exceed the reduced max open interest limit. This breaks the business logic: the max open interest limit is not supposed to be exceeded.

Proof of Concept

In the test file: 02.PairsContract.js, add below test in Section describe('Protocol-only functions', function () :

    it('Reduce max open interest limit to lower than short/long open interest', async function () {
        //@audit added
        await pairscontract.connect(owner).addAsset(99, 'XYZ/ABC', ethers.constants.AddressZero, ethers.utils.parseEther('1'), ethers.utils.parseEther('100'), 1e10, 3e9);
        await pairscontract.connect(owner).setProtocol(NewTrading.address);
        await pairscontract.connect(owner).setMaxOi(99, StableToken.address, ethers.utils.parseEther('2000'));
        await pairscontract.connect(NewTrading).modifyLongOi(99, StableToken.address, true, ethers.utils.parseEther('500'));
        await pairscontract.connect(NewTrading).modifyShortOi(99, StableToken.address, true, ethers.utils.parseEther('2000'));
        let [longOi, shortOi] = await pairscontract.idToOi(99, StableToken.address);
        expect(longOi).to.equal(ethers.utils.parseEther('500'));
        expect(shortOi).to.equal(ethers.utils.parseEther('2000'));
        await expect(pairscontract.connect(owner).setMaxOi(99, StableToken.address, ethers.utils.parseEther('100'))).not.to.be.reverted;
    });

Tools Used

N/A.

Recommended Mitigation Steps

One of the possible solution is to limit the max open interest limit to the maximum value of the existing assets' long/short open interests; or to set the max open interest limit as a constant.