Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-23·

Token mismatch in `operationalTreasury` affects pool payouts

Not reportedoptionsleverageblack-scholes
TL;DR

The protocol potentially has inconsistent token transfer for pnl payouts between OperationalTreasury and Pool contracts.

Severity
LOW
Method
MManual review
CAT.

The protocol potentially has inconsistent token transfer for pnl payouts between OperationalTreasury and Pool contracts. While Pool uses the position's buyToken for payouts, OperationalTreasury uses the current baseSetUp.token. If OperationalTreasury is updated and reinitialized the base setup with a different base token, users will receive payouts in the wrong token.

solidity
function payOff(uint256 positionID, address account) external override nonReentrant whenNotPaused {
--- SNIPPED ---
if (pnl > 0) baseSetUp.token.safeTransfer(account, netAmount);
emit Paid(positionID, account, netAmount, feesUSD);
}
solidity
function _payout(Position memory pos, PositionClose memory close) internal returns (uint256 pnl) {
--- SNIPPED ---
strg.ledger.state.poolAmount[pos.buyToken] -= pnl;
_doTransferOut(pos.buyToken, msg.sender /* operational treasury*/, pnl);
}

Recommendation:

Record the original baseSetUp.token or buyToken with each position in the OperationalTreasury and use it for payouts.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-23