https://github.com/devZygo/zygoAuditHacken

When merging two positions, the protocol incorrectly updates the old position’s accFundingFeePerSize (the cumulative funding fee rate) to the new position’s stored value instead of the current global funding fee state. This allows attackers to exploit stale funding rate data, leading to systematic undercharging or overcharging of funding fees. Impact Protocol/User Fund Loss: Attackers can arbitrage the discrepancy between stale and current funding rates to drain protocol funds or unfairly profit.

Permanent Financial Imbalances: Incorrect fee calculations create unrecoverable losses for LPs or traders.

Setup:

Deploy the PerpDex contract.

Open two positions:

• Position A (Alice): accFundingFeePerSize = 100
• Position B (Bob): accFundingFeePerSize = 200 (opened after a funding rate update).

Exploit:

Trigger a funding rate update (e.g., via market volatility), setting the global accFeePerSize to 300.

Merge Position A and B. Observe:

oldPosition.accFundingFeePerSize = newPosition.accFundingFeePerSize; // Sets to 200 instead of 300  

Calculate Fees:

After merging, the funding fee for the merged position is computed as:

fee = size * (currentAccFeePerSize - mergedAccFeePerSize) // 300 - 200 = 100  

• Expected Fee: 300 - 100 = 200 (using Position A’s original rate).
• Actual Fee: 100 (due to incorrect update).

Result:

• Protocol loses 100 units of fees per merged position.

• Attacker gains 100 units of profit.

Proof of Concept (PoC) Scenario

Actors:

• Alice: Legitimate trader with Position A.
• Bob: Attacker exploiting the bug.

Steps:

1. Initial State:

Global accFeePerSize = 100.

Alice opens Position A (accFundingFeePerSize = 100).

2. Funding Rate Increase:

Market conditions push accFeePerSize to 200.

3. Bob’s Action:

Opens Position B (accFundingFeePerSize = 200).

Merges Position B with Alice’s Position A.

4. Post-Merge State:

Merged position’s accFundingFeePerSize is 200 (instead of current global rate 200).

5. Second Rate Increase:

Global accFeePerSize rises to 300.

6. Fee Calculation:

Correct Liability: 300 - 100 = 200.

Actual Liability: 300 - 200 = 100.

7. Outcome:

Protocol loses 100 units per merged position.

Bob profits by avoiding 100 units of fees.