MarginAccount.sol - Asset transfer to insuranceFund is lost.

Lines of code Vulnerability details Impact MarginAccount.sol - Line 377, token asset is transferred into insuranceFund but not found any function to transfer asset out of insuranceFund. Proof of Concept Add any ERC20 token to Collateral list Call settleBadDebt Recommended Mitigation Steps Add...

Insurance slippage reimbursement can be used to steal insurance fund

Handle cmichel Vulnerability details The Liquidation contract allows the liquidator to submit "bad" trade orders and the insurance reimburses them from the insurance fund, see Liquidation.claimReceipt. The function can be called with an orders array which does not check for duplicate orders. An...