Description

When a new trade is created, the value of groupsCollaterals is increased by the amount of collateral added in that trade. This ensures that the total collateral of the group does not increase the groupMaxCollateral, as verified in the withinExposureLimits function. Although the group collateral is updated using updateGroupCollateral when new trade is created, this value is not updated when topUpCollateral is called to add more collateral in an open trade.

Additionally, the verification to ensure that the new groupsCollaterals remains below the groupMaxCollateral is absent within the same function.

Impact

When collateral is added using the topUpCollateral function, the new collateral could bypass the groupMaxCollateral, breaking the invariant.

Recommendations

Add the new collateral value to the groupsCollaterals mapping and verify that the new value of groupsCollaterals remains below the groupMaxCollateral.

Remediation

This issue has been acknowledged by Ostium Labs, and a fix was implemented in commit 6181f69e↗.