Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-22·

Omission of `_refreshVirtualPoolValue()` causes stale fees and PLP price

Not reportedoptionsleverageblack-scholes
TL;DR

The _payout() function in PositionInteractionFacet updates pool balances but fails to update the virtual pool state and emit updated PLP pricing.

Severity
LOW
Method
MManual review
CAT.

The _payout() function in PositionInteractionFacet updates pool balances but fails to update the virtual pool state and emit updated PLP pricing. This leads to stale virtual pool values used in dynamic fee calculations and outdated PLP price reporting.

The issue occurs because:

  1. Pool balance changes in _payout(): poolAmount[pos.uAsset] and/or poolAmount[pos.buyToken], affect total pool value.

  2. Stale virtualNetPoolValue values affect dynamic fee application:

solidity
function _calcFeeRate(...) internal view returns (int256 delta, uint256 feeRate) {
if (PoolStorage.layout().setUp.assets.totalWeight == 0
|| PoolStorage.layout().ledger.state.virtualNetPoolValue == 0
) return (0, feeRate);
}
  1. PLP price emissions are also missed.

Recommendation:

Apply _refreshVirtualPoolValue() and _emitPLPPrice() called in _payout().

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-22