settle() does not allow forfeiting of put options, which prevent release of locked WETH when required

[code423n4]

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/main/contracts/perp-vault/PerpetualAtlanticVault.sol#L315-L333

Vulnerability details

settle() is used by RdpxV2Core admin to close PerpetualAtlanticVault put options and realize the profits when they are ITM.

However, it does not allow forfeiting of put options, which means there is no mechanism to unlock the associated locked WETH unless they are ITM.

There are scenarios where such a function is required, such as during an emergency or migration (transferring to a new vault version and deprecating the existing vault). In these cases, there is no mechanism to unlock the WETH associated with the OTM put options. Furthermore, in these situation, funding payment for the OTM options will likely be paused as well.

Impact

Without a mechanism to forfeit put options, the associated locked WETH will be stuck in PerpetualAtlanticVaultLP without any mechanism to release them.

Proof of Concept

scenario 1 - migration

1. An migration takes place and holders of PerpetualAtlanticVaultLP are advised to redeem and withdraw their WETH and rDPX tokens.
2. RdpxV2Core admin can only close the ITM put options and release the rDPX.
3. However, there are still WETH locked associated with the active OTM put options.
4. RdpxV2Core admin is not able to close the active OTM put options. The associated WETH remains locked for extended period of time.
5. Due to the migration, RdpxV2Core will no longer pay funding for the OTM put options as all funds are withdrawn.
6. Holders of PerpetualAtlanticVaultLP will not be able to retrieve the locked WETH associated the OTM put options. At the same time, they are also not receiving any fundings for the locked WETH.

Scenario 2 - unpausing after extended pause due to emergency

1. Suppose we have active options at strike price of 100.
2. At epoch N, price = 120 (price > strike), so option is still OTM.
3. Now the contract are paused due to an emergency.
4. At the end of epoch N, contracts are still paused so admin is not able to calculateFunding() and provideFunding() for epoch N+1. That means there are no funding payment for Epoch N+1.
5. At epoch N+1, the contracts are unpaused and resumes operation.
6. Now price has dropped to 80 (price < strike), so option is ITM.
7. Admin proceed to settle() and realize the profits from the active options.
8. Option writer then suffer a loss despite not receiving any funding payment for epoch N+1.

Recommended Mitigation Steps

Add the ability for settle() to forfeit put options.

Assessed type

Other

[c4-pre-sort]

bytes032 marked the issue as sufficient quality report

[c4-pre-sort]

bytes032 marked the issue as primary issue

[c4-sponsor]

psytama marked the issue as disagree with severity

[psytama]

There is no exploit or loss of funds.

[c4-judge]

GalloDaSballo marked the issue as unsatisfactory:
Insufficient proof

[c4-judge]

GalloDaSballo removed the grade

[c4-judge]

GalloDaSballo changed the severity to QA (Quality Assurance)

[GalloDaSballo]

Downgrading to QA for Documentation

[peakbolt]

Hi @GalloDaSballo ,

this issue has the same root cause as #1956, as it is referring to the inability to settle OTM options. I use the term "forfeit options" as it is stated the docs under Atlantic Perpetual PUTS Options https://dopex.notion.site/rDPX-V2-RI-b45b5b402af54bcab758d62fb7c69cb4.

[c4-judge]

This previously downgraded issue has been upgraded by GalloDaSballo

[GalloDaSballo]

Agree

[c4-judge]

GalloDaSballo marked the issue as duplicate of #1956

[c4-judge]

GalloDaSballo marked the issue as satisfactory