PerpDespository#reblance and rebalanceLite can be called to drain funds from anyone who has approved PerpDepository
PerpDespository#reblance and rebalanceLite allows anyone to specify the account that pays the quote token. These functions allow a malicious user to abuse any allowance provided to PerpDirectory. rebalance is the worst of the two because the malicious user could sandwich attack the rebalance to steal all the funds and force the unsuspecting user to pay the `shortfall`.\\n```\\nfunction rebalance(\\n    uint256 amount,\\n    uint256 amountOutMinimum,\\n    uint160 sqrtPriceLimitX96,\\n    uint24 swapPoolFee,\\n    int8 polarity,\\n    address account // @audit user specified payer\\n) external nonReentrant returns (uint256, uint256) {\\n    if (polarity == -1) {\\n        return\\n            _rebalanceNegativePnlWithSwap(\\n                amount,\\n                amountOutMinimum,\\n                sqrtPriceLimitX96,\\n                swapPoolFee,\\n                account // @audit user address passed directly\\n            );\\n    } else if (polarity == 1) {\\n        // disable rebalancing positive PnL\\n        revert PositivePnlRebalanceDisabled(msg.sender);\\n        // return _rebalancePositivePnlWithSwap(amount, amountOutMinimum, sqrtPriceLimitX96, swapPoolFee, account);\\n    } else {\\n        revert InvalidRebalance(polarity);\\n    }\\n}\\n```\\n\\n`rebalance` is an unpermissioned function that allows anyone to call and `rebalance` the PNL of the depository. It allows the caller to specify the an account that passes directly through to `_rebalanceNegativePnlWithSwap`\\n```\\nfunction _rebalanceNegativePnlWithSwap(\\n    uint256 amount,\\n    uint256 amountOutMinimum,\\n    uint160 sqrtPriceLimitX96,\\n    uint24 swapPoolFee,\\n    address account\\n) private returns (uint256, uint256) {\\n    // rest of code\\n    // @audit this uses user supplied swap parameters which can be malicious\\n    SwapParams memory params = SwapParams({\\n        tokenIn: assetToken,\\n        tokenOut: quoteToken,\\n        amountIn: baseAmount,\\n        amountOutMinimum: amountOutMinimum,\\n        sqrtPriceLimitX96: sqrtPriceLimitX96,\\n        poolFee: swapPoolFee\\n    });\\n    uint256 quoteAmountOut = spotSwapper.swapExactInput(params);\\n    int256 shortFall = int256(\\n        quoteAmount.fromDecimalToDecimal(18, ERC20(quoteToken).decimals())\\n    ) - int256(quoteAmountOut);\\n    if (shortFall > 0) {\\n        // @audit shortfall is taken from account specified by user\\n        IERC20(quoteToken).transferFrom(\\n            account,\\n            address(this),\\n            uint256(shortFall)\\n        );\\n    } else if (shortFall < 0) {\\n        // rest of code\\n    }\\n    vault.deposit(quoteToken, quoteAmount);\\n\\n    emit Rebalanced(baseAmount, quoteAmount, shortFall);\\n    return (baseAmount, quoteAmount);\\n}\\n```\\n\\n`_rebalanceNegativePnlWithSwap` uses both user specified swap parameters and takes the shortfall from the account specified by the user. This is where the function can be abused to steal funds from any user that sets an allowance for this contract. A malicious user can sandwich attack the swap and specify malicious swap parameters to allow them to steal the entire rebalance. This creates a large shortfall which will be taken from the account that they specify, effectively stealing the funds from the user.\\nExample: Any `account` that gives the depository allowance can be stolen from. Imagine the following scenario. The multisig is going to rebalance the contract for 15000 USDC worth of ETH and based on current market conditions they are estimating that there will be a 1000 USDC shortfall because of the difference between the perpetual and spot prices (divergences between spot and perpetual price are common in trending markets). They first approve the depository for 1000 USDC. A malicious user sees this approval and immediately submits a transaction of their own. They request to rebalance only 1000 USDC worth of ETH and sandwich attack the swap to steal the rebalance. They specify the multisig as `account` and force it to pay the 1000 USDC shortfall and burn their entire allowance, stealing the USDC.
PerpDespository#reblance and rebalanceLite should use msg.sender instead of account:\\n```\\n     function rebalance(\\n        uint256 amount,\\n        uint256 amountOutMinimum,\\n        uint160 sqrtPriceLimitX96,\\n        uint24 swapPoolFee,\\n        int8 polarity,\\n-       address account\\n    ) external nonReentrant returns (uint256, uint256) {\\n        if (polarity == -1) {\\n            return\\n                _rebalanceNegativePnlWithSwap(\\n                    amount,\\n                    amountOutMinimum,\\n                    sqrtPriceLimitX96,\\n                    swapPoolFee,\\n-                   account \\n+                   msg.sender\\n                );\\n        } else if (polarity == 1) {\\n            // disable rebalancing positive PnL\\n            revert PositivePnlRebalanceDisabled(msg.sender);\\n            // return _rebalancePositivePnlWithSwap(amount, amountOutMinimum, sqrtPriceLimitX96, swapPoolFee, account);\\n        } else {\\n            revert InvalidRebalance(polarity);\\n        }\\n    }\\n```\\n
Anyone that gives the depository allowance can easily have their entire allowance stolen
```\\nfunction rebalance(\\n    uint256 amount,\\n    uint256 amountOutMinimum,\\n    uint160 sqrtPriceLimitX96,\\n    uint24 swapPoolFee,\\n    int8 polarity,\\n    address account // @audit user specified payer\\n) external nonReentrant returns (uint256, uint256) {\\n    if (polarity == -1) {\\n        return\\n            _rebalanceNegativePnlWithSwap(\\n                amount,\\n                amountOutMinimum,\\n                sqrtPriceLimitX96,\\n                swapPoolFee,\\n                account // @audit user address passed directly\\n            );\\n    } else if (polarity == 1) {\\n        // disable rebalancing positive PnL\\n        revert PositivePnlRebalanceDisabled(msg.sender);\\n        // return _rebalancePositivePnlWithSwap(amount, amountOutMinimum, sqrtPriceLimitX96, swapPoolFee, account);\\n    } else {\\n        revert InvalidRebalance(polarity);\\n    }\\n}\\n```\\n