Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Tradoor>Threat Model>Message: LiquidatePerpPosition
GeneralOverview
Findings
High (1)
Medium (1)
Low (1)
Informational (4)
DiscussionTest suiteUnused isPending flag on perpetual ordersLimited contract storage enables denial-of-service attacks
Threat ModelWhat are threat models?
1-usdt_pool.tactMessage: ListTokenMessage: CancelPerpOrderMessage: ExecutePerpOrderMessage: LiquidatePerpPositionMessage: ADLPerpPositionMessage: UpdateBaseConfigMessage: SetManagerMessage: JettonUpdateContentMessage: DelistTokenMessage: ClaimProtocolFeeMessage: FeedPricesMessages: CreateCompensate and ExecuteOrCancelCompensateMessage: JettonTransferNotificationMessage: CancelLiquidityOrderMessage: ExecuteLiquidityOrderMessage: CreateDecreasePerpOrderMessage: CreateTpSlPerpOrder
2-ton_pool.tact
Audit ResultsAssessment Results

Message: LiquidatePerpPosition

As described by the comment above the message handler,

/** * This function is called when a LiquidatePerpPosition message is received. * It performs various checks, adds a new order to the order book, and sends an update position message to the pool. * * @param msg The LiquidatePerpPosition message containing information about the liquidation. */

Inputs

The incoming message has the following structure:

message LiquidatePerpPosition { liquidationFeeReceiver: Address?; tokenId: Int as uint16; account: Address; isLong: Bool; trxId: Int as uint64; price: Int as uint128; premiumRate: Int as int32; fundingFeeGrowth: Int as int128; rolloverFeeGrowth: Int as int128; }

  • liqudationFeeReceiver

    • Validation: None.

    • Impact: Not used by the contract, liquidation fees are not collected. The name implies this should determine which address should receive the liquidation fee. If not provided in the message, the caller's address is used.

  • tokenId

    • Validation: Must have an existing configuration in tokenConfigs.

    • Impact: Specifies which tokenId is being liquidated.

  • account

    • Validation: Must have an open position for the tokenId.

    • Impact: Specifies which position is being liquidated.

  • isLong

    • Validation: None.

    • Impact: Specifies the direction the position is being liquidated.

  • trxId

    • Validation: None.

    • Impact: Not used by the on-chain contract.

  • price

    • Validation: None.

    • Impact: The trade price to use when calculating the PNL.

  • premiumRate

    • Validation: None.

    • Impact: Not used by the on-chain contract.

  • fundingFeeGrowth

    • Validation: None.

    • Impact: Used to compute the funding fees.

  • rolloverFeeGrowth

    • Validation: None.

    • Impact: Used to compute rollover fees.

Test coverage

Intended branches

Negative behavior

Zellic © 2025Back to top ↑