Permanent lock due to missing unlock mechanism for options

Impact: High

Likelihood: High

The protocol has a critical issue where liquidity can be permanently locked in the pool when options are not exercised within the specified window(exerciseWindowDuration) or have 0 PNL(at a loss). Here's the problematic flow:

// In PositionInteractionFacet.sol
function _lockLiquidity(Position memory pos) internal {
    PoolStorage.Layout storage strg = PoolStorage.layout();
    if (pos.opType == OptionType.CALL)
        strg.ledger.state.lockedToken[pos.uAsset] += pos.sizeUa;
    else if (pos.opType == OptionType.PUT)
        strg.ledger.state.lockedUSD += pos.sizeUSD;
}

// In StrategyView.sol
function isPayoffAvailable(uint256 positionID, address caller, address /*recipient*/ )
    external
    view
    virtual
    override
    returns (bool)
{
    return strg.setUp.treasury.manager().isApprovedOrOwner(caller, positionID)
        && _calculateStrategyPayOff(positionID) > 0
        && block.timestamp >= maturity
        && block.timestamp <= maturity + strg.setUp.base.exerciseWindowDuration;
}

The issue manifests in several ways:

• Liquidity is locked when an option is created.
• Liquidity is only unlocked through exerciseOrLiquidatePosition.
• exerciseOrLiquidatePosition is only called during payoff.
• payoff is only available when:
  • The option is profitable (_calculateStrategyPayOff > 0).
  • Within the exercise window (maturity to maturity + exerciseWindowDuration).

This creates scenarios where liquidity becomes permanently locked:

• Options not exercised within the time window.
• Options where the holder fails to exercise.

Additionally, this creates a potential attack vector:

1. The attacker opens multiple options with small premiums.
2. Intentionally doesn't exercise them.
3. Causes permanent locking of pool liquidity.

Implement an unlock mechanism for this situation.

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.