Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-09·

Risk corruption from uncontrolled id in `setPositionsManager`

Not reportedoptionsleverageblack-scholes
TL;DR

The AdminOperationalTreasury.setPositionsManager() function allows the protocol admin to replace the active PositionsManager contract.

Severity
LOW
Method
MManual review
CAT.

The AdminOperationalTreasury.setPositionsManager() function allows the protocol admin to replace the active PositionsManager contract. However, it does not enforce any validation on the new manager’s position ID counter (nextTokenId()).

Position IDs are used as shared keys across multiple components, including position storage, strategy tracking, and payout logic. If a new PositionsManager is registered and begins minting IDs that collide with existing ones, it will overwrite or corrupt the existing position state, leading to data inconsistencies or even fund loss.

Consider adding a check when assigning a new position manager to ensure ID sequence continuity.

diff
function setPositionsManager(address manager_) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {
- OperationalTreasuryStorage.layout().setUp.base.manager = IPositionsManager(manager_);
+ uint256 currentNextId = OperationalTreasuryStorage.layout().setUp.base.manager.nextTokenId();
+ if (currentNextId < IPositionsManager(manager_).nextTokenId()) revert InvalidPositionManager();
OperationalTreasuryStorage.layout().setUp.base.manager = IPositionsManager(manager_);
}
02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-09