0x52 - Design of BufferBinaryPool allows LPs to game option expiry

[sherlock-admin]

0x52

high

Design of BufferBinaryPool allows LPs to game option expiry

Summary

When an option is created, enough collateral is locked in BufferBinaryPool to cover a payout should it close ITM. As long as an LP isn't locked (trivially 10 minutes) and there is sufficient liquidity they can cash out their shares for underlying. The price and expiration of all options are public by design, meaning an LP can know with varying degrees of certainty if they will make or lose money from an option expiry. The result is that there will be a race to withdraw capital before any option expires ITM. LPs who make it out first won't lose any money, leaving all other LPs to hold the bags.

On the flip-side of this when there are large options expiring OTM, LPs will rush to stake their capital in the pool. This allows them to claim the payout while experiencing virtually zero risk, since they can immediately withdraw after 10 minutes.

Vulnerability Detail

See summary.

Impact

LPs can game option expiry at the expense of other LPs

Code Snippet

https://github.com/sherlock-audit/2022-11-buffer/blob/main/contracts/contracts/core/BufferBinaryPool.sol#L124-L126

Tool used

Manual Review

Recommendation

I strongly recommend an epoch based withdraw and deposit buffer to prevent a situation like this. Alternatively increasing lockupPeriod would be a quicker, less precise fix.

[bufferfinance]

Yes we were planning to adjust the lockup accordingly.

[bufferfinance]

Doesn't need to be fixed. The admin will adjust the config accordingly.

[IAm0x52]

Fixed in PR#9

lockupPeriod is now set in constructor so that it is adjustable