Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Orderly Network>Threat Model>executeAdl
GeneralOverview
Findings
Critical (1)
High (3)
Medium (4)
Informational (1)
DiscussionAdditional checksOverall issues with some functionsThe `changeFeeCollector` does not revertThe `tokenHash` is not a hash from `tokenAddress`
Threat ModelWhat are threat models?AccountTypeHelper.solAccountTypePositionHelper.solCrossChainRelayUpgradeable.solFeeManager.sol
Ledger.solaccountDepositaccountWithDrawFinishexecuteAdlexecuteLiquidationexecuteProcessValidatedFuturesexecuteSettlementexecuteWithdrawActionsetCrossChainManagersetFeeManagersetMarketManagersetOperatorManagerAddresssetVaultManager
LedgerComponent.solLedgerCrossChainManagerUpgradeable.solMarketManager.solOperatorManager.solOperatorManagerComponent.solSignature.solVault.solVaultCrossChainManagerUpgradeable.solVaultManager.sol
Audit ResultsSummary

Function: executeAdl(EventTypes.Adl adl, uint64 eventId)

This executes auto-deleveraging action. Can be called only by the OperatorManager contract over the eventUpload function, which is available only for Operator.

  1. userPosition.positionQty should not be zero.

  2. positionQtyTransfer.abs should not be more than userPosition.positionQty.

struct Adl { bytes32 accountId; - The account for which the position will be done, auto-deleveraging action. bytes32 insuranceAccountId; bytes32 symbolHash; //@audit should be validated that it is allowed. int128 positionQtyTransfer; - It should not be more than `positionQty` of `userPosition`. The `positionQty` of user position should be decreased by this value. int128 costPositionTransfer; - The `costPosition` of the user position should be decreased by this value. uint128 adlPrice; - The `lastExecutedPrice` will be updated by this value. int128 sumUnitaryFundings; uint64 timestamp; - It is not used. }

Inputs

  • adl

    • Control: Full control by operator.

    • Constraints: Only one check that abs(absolute value) of positionQtyTransfer should not be more than abs of userPosition.positionQty.

    • Impact: N/A.

  • eventId

    • Control: Full control by operator.

    • Constraints: There are not any checks.

    • Impact: The unique ID of action.

Function call analysis

  • userPosition.chargeFundingFee(adl.sumUnitaryFundings);

    • External/Internal? Internal.

    • Argument control? adl.sumUnitaryFundings is controlled by caller.

    • Impact: Charge funding fee for userPosition.

  • insurancePosition.chargeFundingFee(adl.sumUnitaryFundings);

    • External/Internal? Internal.

    • Argument control? adl.sumUnitaryFundings is controlled by caller.

    • Impact: Charge funding fee for insurancePosition.

  • userPosition.calAverageEntryPrice(adl.positionQtyTransfer, adl.adlPrice.toInt128(), -adl.costPositionTransfer)

    • External/Internal? Internal.

    • Argument control? positionQtyTransfer, adlPrice, and costPositionTransfer are controlled.

    • Impact: Change averageEntryPrice and openingCost.

Zellic © 2025Back to top ↑