shaka - Position can fall below minimum acceptable quote value after partial closing

[sherlock-admin]

shaka

medium

Position can fall below minimum acceptable quote value after partial closing

Summary

The remaining quote value is not checked when a partial cancellation of a position in the CANCEL_CLOSE_PENDING status is requested, which might lead to a situation where the remaining quote value is too low.

Vulnerability Detail

The protocol has a minimum acceptable quote value that tries to prevent the existence of quotes or positions with a value that is too small, which might descent into situations where there is no economic incentive to act on the position.

When creating a new quote, opening a position, requesting to close a position or closing a position, it is checked that the remaining quote value is not too low. However, when a partial cancellation of a position in the CANCEL_CLOSE_PENDING status is requested, the remaining quote value is not checked, which might lead to a situation where the remaining quote value is too low.

Impact

The remaining quote value might be too low, which might lead to a situation where there is no economic incentive to act on the position, creating a loss of funds for the user.

Code Snippet

https://github.com/sherlock-audit/2023-06-symmetrical/blob/main/symmio-core/contracts/libraries/LibQuote.sol#L195-L207

Tool used

Manual Review

Recommendation

        } else if (
            quote.quoteStatus == QuoteStatus.CANCEL_CLOSE_PENDING || quote.quantityToClose == 0
        ) {
            quote.quoteStatus = QuoteStatus.OPENED;
            quote.requestedClosePrice = 0;
            quote.quantityToClose = 0; // for CANCEL_CLOSE_PENDING status
-       } else {
+       }
+       if (quote.closedAmount != quote.quantity && quote.quantityToClose > 0) {
            require(
                quote.lockedValues.total() >=
                    SymbolStorage.layout().symbols[quote.symbolId].minAcceptableQuoteValue,
                "LibQuote: Remaining quote value is low"
            );
        }

Duplicate of #248