Fees are not collected from traders in addToPosition

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/Trading.sol#L278

Vulnerability details

Impact

The protocol doesn't receive fees when margin is added via the addToPosition function. An equal amount of tigUSD is minted even though it's not backed by margin.

Proof of Concept

The protocol takes fees from margin provided by users: for example, when opening a market order:

1. fees are calculated on the total order size (margin * leverage): Trading.sol#L178;
2. full margin is transferred from the trader (fees are not subtracted): Trading.sol#L180;
3. accounted margin excludes fess: Trading.sol#L183-L194 (see _marginAfterFees).

Thus, traders provide full margin when opening orders and fees are subtracted from accounted margin. If trader closes an order, they'll receive margin - fees.

The protocol also allows traders to add margin to existing positions at a different price, via the addToPosition function (Trading.sol#L255). This function, however, subtracts fees from margin before transferring margin from traders:

_handleDeposit(
    _trade.tigAsset,
    _marginAsset,
    _addMargin - _fee, // @audit trader won't pay fees
    _stableVault,
    _permitData,
    _trader
);

As a result, the protocol doesn't receive fees when margin is added via addToPosition.

Tools Used

Manual review

Recommended Mitigation Steps

Consider not subtracting fees from _addMargin in addToPosition when calling _handleDeposit.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #659

[c4-judge]

GalloDaSballo changed the severity to 3 (High Risk)

[c4-judge]

GalloDaSballo marked the issue as satisfactory