Token mismatch in `operationalTreasury` affects pool payouts
The protocol potentially has inconsistent token transfer for pnl payouts between OperationalTreasury and Pool contracts.
The protocol potentially has inconsistent token transfer for pnl payouts between OperationalTreasury and Pool contracts. While Pool uses the position's buyToken for payouts, OperationalTreasury uses the current baseSetUp.token. If OperationalTreasury is updated and reinitialized the base setup with a different base token, users will receive payouts in the wrong token.
function payOff(uint256 positionID, address account) external override nonReentrant whenNotPaused {--- SNIPPED ---if (pnl > 0) baseSetUp.token.safeTransfer(account, netAmount);emit Paid(positionID, account, netAmount, feesUSD);}
function _payout(Position memory pos, PositionClose memory close) internal returns (uint256 pnl) {--- SNIPPED ---strg.ledger.state.poolAmount[pos.buyToken] -= pnl;_doTransferOut(pos.buyToken, msg.sender /* operational treasury*/, pnl);}
Recommendation:
Record the original baseSetUp.token or buyToken with each position in the OperationalTreasury and use it for payouts.
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.