Rubicon — Precision loss makes openPosition leverage higher than expected

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the. Standalone Foundry PoC and full write-up: 48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the_exp in the evm-hack-registry mirror.

Vulnerability classes: precision-loss · integer-bounds · liquidation-underwater

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the_exp.sol.

Key info#


Impact	HIGH — leverage=1e18+1 floors desired to initMargin; lastBorrow=0 triggers 100% CF borrow (~1.7x)
Protocol	Rubicon
Bug class	precision-loss · integer-bounds · liquidation-underwater
Finding	Code4rena 2023-04-rubicon · #48955 · H-16 · reporter cccz
Report	code4rena.com/reports/2023-04-rubicon
Source	AuditVault
Status	Confirmed. Reproduced as a standalone local synthetic.
Compiler	`^0.8.24` (PoC)

TL;DR#

wmul floor makes desired==init; lastBorrow=0 is treated as full borrow instead of zero extra leverage.

The vulnerable code#

See synthetic test/48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the.sol (@> VULN markers).

Fix: Treat lastBorrow==0 with no excess as zero borrow; tighten leverage precision.

Root cause#

wmul floor makes desired==init; lastBorrow=0 is treated as full borrow instead of zero extra leverage.

Preconditions#

Protocol deployed with the vulnerable code paths from the Code4rena contest.

Attack walkthrough#

See PoC run() and output.txt.

Diagrams#

sequenceDiagram participant User participant Protocol User->>Protocol: trigger vulnerable path Protocol->>Protocol: hit @> VULN line Protocol-->>User: harm realized

Impact#

leverage=1e18+1 floors desired to initMargin; lastBorrow=0 triggers 100% CF borrow (~1.7x)

Taxonomy#

genome: precision-loss · integer-bounds · liquidation-underwater
severity/high · platform/code4rena

Sources#

AuditVault finding #48955
Code4rena report 2023-04-rubicon
Repo@commit: code-423n4/2023-04-rubicon · contracts/utilities/poolsUtility/Position.sol _borrowLimit / openPosition

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the_exp (evm-hack-registry mirror).
AuditVault finding: 48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync