Description

When a limit-close order is executed via executeLimitOrder, the callback function checks if the current price (a.price) is in the correct range depending on the type of the limit order.

function executeLimitCloseOrderCallback(AggregatorAnswer memory a)
external override onlyPriceAggregator {
    //...
    if (o.orderType == ITradingStorage.LimitOrder.LIQ) {
        uint liqPrice = pairInfos.getTradeLiquidationPrice(
            t.trader,
            t.pairIndex,
            t.index,
            t.openPrice,
            t.buy,
            v.posUSDC,
            t.leverage
        );
        v.reward = (t.buy ? a.price <= liqPrice : a.price >= liqPrice) ?
            (v.posToken * liqFeeP) / 100 : 0;
    } else {
        v.reward = (o.orderType == ITradingStorage.LimitOrder.TP &&
            t.tp > 0 &&
            (t.buy ? a.price >= t.tp : a.price <= t.tp)) ||
            (o.orderType == ITradingStorage.LimitOrder.SL &&
                t.sl > 0 &&
                (t.buy ? a.price <= t.sl : a.price >= t.sl))
            ? (
                v.posToken.mul(t.leverage) *
                aggregator.pairsStorage().pairLimitOrderFeeP(t.pairIndex)
            ) / 100 / _PRECISION
            : 0;
    }
    //...
}

It might be possible that the bot executes the limit-close order with a minor delay, during which the price falls out of the correct range and the order is not executed.

For example, for a stop loss to be triggered, the stop loss should be greater than the current price if the order is a buy order. The bot verifies the price at every block, and if it finds an order where stop loss is greater than the current price, it executes a limit close on that trade. But due to some latency in the bot, it might be possible that it calls the executeLimitOrder at the time the price goes above the stop loss — due to which, it will not be triggered.

Impact

Limit-close orders might not be executed in case of bot latency. In the worst case scenario, it means that stop loss, take profits, and liquidation will not be executed.

Recommendations

We recommend tracking the highs and lows between the time an order is placed (or the SL/TP is updated) until the time the executeLimitOrder is called, and only execute the order if the liqPrice / t.tp / t.sl (depending on the type of order) falls in between that range.

Remediation

Avantis plans to remediate this issue through more robust backend infrastructure for liquidation bots.