Description

When a trade is closed at a loss in _unregisterTrade, the collateral that is lost is allocated as a reward:

if (pnl < 0) {
    storageT.vaultManager().allocateRewards(
        uint(-pnl) + totalFees - _feeAmountToken);
}

When a reward is allocated, it is divided between Tranche and VeTranche depending on the amount of locked assets. This seems safe because the expectation is that the reward is not needed in the future — it becomes profit to the LPs.

However, the inflow of funds due to losing trades is actually needed to offset the outflow of funds due to other winning trades. So, this inflow cannot be considered a reward.

Ideally, across the entire protocol, there should be a high volume of trades, and for each asset the total leveraged long position should equal the total leveraged short position across all the open positions (zero skew). If this is the case, then when the price changes, the large inflow of collateral due to the losing trades is roughly equal in magnitude to the large outflow of collateral due to the winning trades.

Therefore, if the inflow is routed both to Tranche and VeTranche, and the outflow that matches the inflow in size is taken only from Tranche, Tranche will quickly run out of money as more and more money gets stuck in the VeTranche rewards.

Impact

In the ideal case where there is high volume and zero skew, when inflow and outflow of USDC is averaged over all the trades in the system, Tranche will quickly run out of money. This causes traders to be unable to open new trades and LPs who do not lock their shares to lose money to LPs that do lock their shares.

Recommendations

Instead of allocating the proceeds obtained from losing positions as rewards, send them only to Tranche with the expectation that other winning positions will need them when they close.

Remediation

This issue has been acknowledged by Avantis Labs, Inc., and a fix was implemented in commit 36126985↗.