Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Orderly Network>Threat Model>executeSettlement
GeneralOverview
Findings
Critical (1)
High (4)
Medium (3)
Informational (1)
DiscussionAdditional checksOverall issues with some functionsThe `changeFeeCollector` does not revertThe `tokenHash` is not a hash from `tokenAddress`
Threat ModelWhat are threat models?AccountTypeHelper.solAccountTypePositionHelper.solCrossChainRelayUpgradeable.solFeeManager.sol
Ledger.solaccountDepositaccountWithDrawFinishexecuteAdlexecuteLiquidationexecuteProcessValidatedFuturesexecuteSettlementexecuteWithdrawActionsetCrossChainManagersetFeeManagersetMarketManagersetOperatorManagerAddresssetVaultManager
LedgerComponent.solLedgerCrossChainManagerUpgradeable.solMarketManager.solOperatorManager.solOperatorManagerComponent.solSignature.solVault.solVaultCrossChainManagerUpgradeable.solVaultManager.sol
Audit ResultsSummary

Function: executeSettlement(EventTypes.Settlement settlement, uint64 eventId)

This processes the settlement execution. The function is called only by the OperatorManager contract, which can be triggered only by the trusted operator.

struct Settlement { bytes32 accountId; - The `accoundId` owns the positions that will be settled. bytes32 settledAssetHash; - The hash of the token will be settled. bytes32 insuranceAccountId; - The account that will provide insurance funds to `accountId`. int128 settledAmount; - The sum of `SettlementExecution.settledAmount` should be equal to this `settledAmount`. uint128 insuranceTransferAmount; - The amount of funds will be transferred from `insuranceAccountId` to `accountId`. uint64 timestamp; - It is not used. SettlementExecution[] settlementExecutions; - The list of settlement objects. } struct SettlementExecution { bytes32 symbolHash - Should be checked that it is allowed. uint128 markPrice; int128 sumUnitaryFundings; int128 settledAmount; - The sum of `SettlementExecution.settledAmount` should be equal to this `settledAmount`. }

Function call analysis

  • insuranceFund.subBalance(settlement.settledAssetHash, settlement.insuranceTransferAmount);

    • External/Internal? Internal.

    • Argument control? All arguments are controlled by operator.

    • Impact: Decrease the balance of insuranceFund account by insuranceTransferAmount.

  • account.addBalance(settlement.settledAssetHash, settlement.insuranceTransferAmount);

    • External/Internal? Internal.

    • Argument control? All arguments are controlled by operator.

    • Impact: Increase the balance of account by insuranceTransferAmount.

  • position.chargeFundingFee(ledgerExecution.sumUnitaryFundings);

    • External/Internal? Internal.

    • Argument control? ledgerExecution.sumUnitaryFundings is controlled by caller.

    • Impact: Charge funding fee.

  • position.isFullSettled()

    • External/Internal? Internal.

    • Argument control?: N/A.

    • Impact: Return true if positionQty == 0 and costPosition == 0.

Zellic © 2024Back to top ↑