Description

The ExecutePerpOrder message contains a tokenId field, which is not used by the message handler. This parameter is not only unused but also unnecessary, since the correct token ID is already recorded in the order stored in the contract.

Additionally, the following messages contain a premiumRate field, which is not used by the contract:

• ExecutePerpOrder, which allows the executor to execute a perpetual order

• LiquidatePerpPosition, which liquidates a user's perpetual position

• ADLPerpPosition, which is used to decrease a user's perpetual position as part of the automatic-deleveraging (ADL) mechanism

Impact

These parameters are unused, and therefore this issue is reported as an Informational code-maturity finding.

Even if the tokenId parameter were used — and not checked to match the token ID of the order being executed — this would not meaningfully affect the threat model of an executor.

All of these message handlers are only callable by the executor, which is already capable of adversely affecting order execution via other parameters such as the asset price.

Recommendations

Remove the unneeded tokenId field from the ExecutePerpOrder message.

Remove premiumRate from the ExecutePerpOrder, LiquidatePerpPosition, and ADLPerpPosition messages.

Remediation