Rubicon — Opening a position reuses prior collateral for borrowing

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 48952-h-13-when-opening-a-position-the-collateral-of-the-previous. Standalone Foundry PoC and full write-up: 48952-h-13-when-opening-a-position-the-collateral-of-the-previous_exp in the evm-hack-registry mirror.

Vulnerability classes: liquidation-logic · direct-drain · account-ownership

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/48952-h-13-when-opening-a-position-the-collateral-of-the-previous_exp.sol.

Key info#

TL;DR#

openPosition borrow budget uses _maxBorrow which includes residual capacity from prior positions on the shared Position account.

The vulnerable code#

See synthetic test/48952-h-13-when-opening-a-position-the-collateral-of-the-previous.sol (@> VULN markers).

Fix: Do not use prior-position residual capacity when sizing a new open.

Root cause#

openPosition borrow budget uses _maxBorrow which includes residual capacity from prior positions on the shared Position account.

Preconditions#

Protocol deployed with the vulnerable code paths from the Code4rena contest.

Attack walkthrough#

See PoC run() and output.txt.

Diagrams#

Impact#

Second openPosition consumes residual borrow room and can hit liquidation threshold

Taxonomy#

• genome: liquidation-logic · direct-drain · account-ownership
• severity/high · platform/code4rena

Sources#

• AuditVault finding #48952
• Code4rena report 2023-04-rubicon
• Repo@commit: code-423n4/2023-04-rubicon · contracts/utilities/poolsUtility/Position.sol ~L537-L550

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 48952-h-13-when-opening-a-position-the-collateral-of-the-previous_exp (evm-hack-registry mirror).
• AuditVault finding: 48952-h-13-when-opening-a-position-the-collateral-of-the-previous.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.