User can abuse tight stop losses and high leverage to make risk free trades #622
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
H-10
primary issue
Highest quality submission among a set of duplicates
selected for report
This submission will be included/highlighted in the audit report
sponsor disputed
Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue
Lines of code
https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/TradingExtension.sol#L88-L120
Vulnerability details
Impact
User can abuse how stop losses are priced to open high leverage trades with huge upside and very little downside
Proof of Concept
When closing a position with a stop loss the user is closed at their SL price rather than the current price of the asset. A user could abuse this in directional markets with high leverage to make nearly risk free trades. A user could open a long with a stop loss that in $0.01 below the current price. If the price tanks immediately on the next update then they will be closed out at their entrance price, only out the fees to open and close their position. If the price goes up then they can make a large gain.
Tools Used
Manual Review
Recommended Mitigation Steps
Take profit and stop loss trades should be executed at the current price rather than the price specified by the user:
The text was updated successfully, but these errors were encountered: