Skip to content
This repository has been archived by the owner on May 26, 2023. It is now read-only.

Latest commit

 

History

History
61 lines (36 loc) · 2.21 KB

057.md

File metadata and controls

61 lines (36 loc) · 2.21 KB

peanuts

medium

Premium gets stucked in BufferBinaryOptions contract when the option expires OTM or ATM

Summary

The premium gets stuck in BufferBinaryOptions contract when the option closes OTM or ATM.

Vulnerability Detail

The first transfer of funds happens when user initiateTrade() and _openQueuedTrade is called().

    tokenX.transfer(queuedTrade.targetContract, revisedFee);

The user's revised funds for the option is transferred to the targetContract, which is the BufferBinaryOptions contract and the remaining fund if transferred back to the user.

    if (revisedFee < queuedTrade.totalFee) {
        tokenX.transfer(
            queuedTrade.user,
            queuedTrade.totalFee - revisedFee
        );
    }

Now, the funds is in the targetContract. The targetContract transfers settlement fee to the config contract when createFromRouter() is called.

    tokenX.transfer(config.settlementFeeDisbursalContract(), settlementFee);

The rest of the fees remain inside the targetContract until the option expires. If the option expires ATM or OTM, the remaining funds stays in the targetContract instead of being transferred to the BufferBinaryPool contract.

function _unlock(uint256 id) internal returns (uint256 premium) {
    LockedLiquidity storage ll = lockedLiquidity[msg.sender][id];
    require(ll.locked, "Pool: lockedAmount is already unlocked");
    ll.locked = false;


    lockedPremium = lockedPremium - ll.premium;
    lockedAmount = lockedAmount - ll.amount;
    premium = ll.premium;
}

Impact

BufferBinaryPool does not get its funds when option expires OTM or ATM. This is particularly important if the Pool contract is lacking funds to pay the winners.

Code Snippet

https://github.com/sherlock-audit/2022-11-buffer/blob/main/contracts/contracts/core/BufferRouter.sol#L331-L339

https://github.com/sherlock-audit/2022-11-buffer/blob/main/contracts/contracts/core/BufferBinaryOptions.sol#L141

https://github.com/sherlock-audit/2022-11-buffer/blob/main/contracts/contracts/core/BufferBinaryOptions.sol#L171-L175

Tool used

Manual Review

Recommendation

Make sure that the remaining funds from targetContract is transferred to BufferBinaryPool.