Description

The loss-protection--tier feature is intended to incentivize traders to submit trades that reduce the current skew, which are trades that inverse the net-demand position of the protocol. However, when a trade is opened, the loss-protection tier is calculated based on the skew after the trade's open interest is applied to the total:

function lossProtectionTier(ITradingStorage.Trade memory _trade)
external view override returns (uint) {
    uint openInterestUSDCLong =
        storageT.openInterestUSDC(_trade.pairIndex, 0);
    uint openInterestUSDCShort =
        storageT.openInterestUSDC(_trade.pairIndex, 1);

    uint updatedInterest = _trade.initialPosToken.mul(_trade.leverage);

    if (!_trade.buy) {
        openInterestUSDCShort += updatedInterest;
        uint openInterestUSDCLongPct = (100 * openInterestUSDCLong) /
            (openInterestUSDCLong + openInterestUSDCShort);
        //...snipped loop checks openInterestUSDCLongPct vs longSkewConfig
    } else {
        openInterestUSDCLong += updatedInterest;
        uint openInterestUSDCShortPct = (100 * openInterestUSDCShort) /
            (openInterestUSDCLong + openInterestUSDCShort);
        //...snipped loop checks openInterestUSDCShortPct vs shortSkewConfig
    }
    return 0; // No Protection Tier
}

For both long and short opens (buys and sells, respectively), the updatedInterest is added to the open interest before calculating the skew.

Impact

This means that a trade that corrects enough skew to move the skew config to a lesser tier will get a lesser degree of loss protection, which is an unexpected result. In the extreme case, if a trader corrects the entire skew with a large transaction, they will get no loss protection. This is counterintuitive to the purpose of the loss-protection feature.

Recommendations

Since loss-protection tiers are a staircase-shaped function, if a trade causes the total open interest to span multiple skew config values, the area under the curve needs to be calculated to determine the total incentive the trader should get. However, currently this incentive is tiered so the trade cannot be awarded half of a tier, so that does not map cleanly.

When we brought up this finding with Avantis, we also noted other concerns with the loss-protection tier feature even when it is working as intended. For example, since loss protection stays with the trade, if a trader creates a trade that is awarded loss protection, and then the protocol skew changes direction, the trader can add any amount of funds to the existing trade using a margin update. This effectively causes the added position to also benefit from the loss protection despite worsening the skew. Also, it is possible to place a temporary trade with a flash loan to intentionally skew the protocol first, before an actual trade is placed, to essentially "buy" loss protection for a fee.

In light of this finding and the other concerns, we recommend rethinking how loss-protection tiers should work to incentivize traders to reduce skew.

Remediation

This issue has been acknowledged by Avantis Labs, Inc., and a fix was implemented in commit dfc3241f↗. This commit adds a per-block open interest limit in order to prevent the use of flash loans to exploit this.