`strategy` contracts: exercise window ignored in premium calculation

Impact: Medium

Likelihood: Medium

The protocol currently allows options to be exercised within a window after the maturity date (i.e., exerciseWindowDuration):

    function isPayoffAvailable(uint256 positionID, address caller, address /*recipient*/ )
        external
        view
        virtual
        override
        returns (bool)
    {
        --snip--
        return strg.setUp.treasury.manager().isApprovedOrOwner(caller, positionID)
            && _calculateStrategyPayOff(positionID) > 0 && block.timestamp >= maturity
@>          && block.timestamp <= maturity + strg.setUp.base.exerciseWindowDuration;
    }

However, the premium calculation does not account for this extended exercise window. This creates an inconsistency, as the price at the maturity date should be used to calculate the value of the option, but the current price after the maturity date is being used instead. An option buyer can wait for the option price to increase after the maturity date, exercise his option at a more favorable price, and gain a positive profit and loss (PnL).

Note: The protocol uses European Options and their pricing model, which assumes options should only be exercised at the maturity date price. However, in the current strategy contracts, exercise is allowed within a window of time (exerciseWindowDuration) after the maturity date. Options are paid off based on the current price, not the maturity date price.

Note: Reducing the exercise window duration will increase the risk of users missing the opportunity to call payOff and losing their potential profit.

Example Scenario (based on tests and scripts numbers):

• Option period = 7 days
• Exercise window duration = 3 days (extension of 50% of the original period)

A user pays the premium for a 7-day option, but after the maturity date, they are allowed an additional 3-day window to exercise the option. During this period, the user can wait for the price to increase and then exercise the option, maximizing their profit. However, the premium is not adjusted to account for this extra time.

To resolve this issue, consider the following alternatives:

1. Always exercise at the maturity date price: Use historical price oracles to ensure that options are exercised at the maturity date price.

2. Include the exercise window duration in the premium calculation: Adjust the premium to fairly reflect the time extension provided by the exerciseWindowDuration, ensuring the premium remains consistent with the option's original value and removing the potential for manipulation.

The alternative one is more aligned with the European options pricing model and also eliminates the need for having a strict window to call payOff to exercise the options.

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.