yixxas - It is still possible for users to lose their funds when the counterparty vault has no deposits

[sherlock-admin]

yixxas

medium

It is still possible for users to lose their funds when the counterparty vault has no deposits

Summary

triggerNullEpoch() is implemented to protect against the case of when one side of the vault has no deposits. However, it is still possible for users to lose funds if triggerNullEpoch() is not called before the end of the epoch, as triggerEndEpoch() can now be called.

Vulnerability Detail

triggerNullEpoch() can be called by anyone once epoch has started and doing so will allow users to withdraw their assets from the vault if counterparty vault is empty. However, in the case where this is not called, for various reasons such as a downtime on arbitrum or simply having no one calling the function, users can lose their deposits.

The issue here is that triggerEndEpoch() can be called as long as block.timestamp > uint256(epochEnd). This will lead to the same issue as found in H-04 in the previous Y2k audit done at C4. code-423n4/2022-09-y2k-finance-findings#312

triggerEndEpoch() can be called regardless of whether it is possible to trigger null epoch. We should enforce the impossibility of it onchain and not rely or assume that triggerNullEpoch() will always be triggered before epoch ends.

Impact

Users can lose deposits when counterparty vault has 0 deposits.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#L160

Tool used

Manual Review

Recommendation

Add an additional check to triggerEndEpoch() to disallow calling of it should one side of the risk/hedge vault have 0 deposits and prevent it from being callable even if block.timestamp > uint256(epochEnd).

Duplicate of #108

[yixxas]

Escalate for 10 USDC

Dupe of #108

[sherlock-admin]

Escalate for 10 USDC

Dupe of #108

You've created a valid escalation for 10 USDC!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[hrishibhat]

Escalation accepted

Valid duplicate of #108

[sherlock-admin]

Escalation accepted

Valid duplicate of #108

This issue's escalations have been accepted!

Contestants' payouts and scores will be updated according to the changes made on this issue.