Protocol loss in case price is far away from stop loss price.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/TradingExtension.sol#L118

Vulnerability details

Impact

Each position when opened on Tigris has an optional stop loss price. Whenever market price drop below stop loss price, the position can be closed automatically by bot. However, there is a flaw in term of what price position should be closed. In the current codebase, even when market price drops below stop loss price, the position is still closed at stop loss price.

function _limitClose(
    uint _id,
    bool _tp,
    PriceData calldata _priceData,
    bytes calldata _signature
) external view returns(uint _limitPrice, address _tigAsset) {
    ...
    if (_tp) {
        ...
    } else {
        if (_trade.slPrice == 0) revert("7"); //LimitNotSet
        if (_trade.direction) {
            if (_trade.slPrice < _price) revert("6"); //LimitNotMet
        } else {
            if (_trade.slPrice > _price) revert("6"); //LimitNotMet
        }
        _limitPrice = _trade.slPrice; 
        // @audit High: Protocol loss in case price far from slPrice. 
        // e.g Long sl = 100, currentPrice = 90, should be close at 90
    }
}

If the market price is drop far away from stop loss price, protocol will result in loss.

Proof of Concept

Consider the scenario

1. Alice has a long position, she set slPrice = 100.
2. When market price is drop to 90, her position is still closed at 100 when it should be closed at 90. So she got 100 - 90 in price diff and this profit is taken from protocol.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider closing position at market price when reaching stop loss. In addition to that, adding check to make sure close price is not too far, for example: more than 1%

[c4-judge]

GalloDaSballo marked the issue as duplicate of #515

[c4-judge]

GalloDaSballo marked the issue as duplicate of #622

[c4-judge]

GalloDaSballo marked the issue as satisfactory

[GalloDaSballo]

Invalidating due to Warden being in breach of the Rules

[c4-judge]

GalloDaSballo marked the issue as nullified