Decreasing and increasing a short's collateral potentially uses an outdated asset price to calculate the collateral ratio
The `decreaseCollateral` and `increaseCollateral` functions in the `ShortRecordFacet` contract calculate the short's collateral ratio based on the cached asset price, which may be outdated, leading to a divergence between the actual collateral ratio (based on the asset spot price) and the calculated collateral ratio.\\nAccording to the conditions for updating the oracle, decreasing the short's collateral via the `ShortRecordFacet.decreaseCollateral` function should update the oracle price if the oracle price is older than 15 minutes.\\nHowever, in the current implementation of the `decreaseCollateral` function, the short's collateral ratio, `cRatio`, is calculated by calling the `getCollateralRatio` function in line 94:\\n```\\nfunction decreaseCollateral(address asset, uint8 id, uint88 amount)\\n    external\\n    isNotFrozen(asset)\\n    nonReentrant\\n    onlyValidShortRecord(asset, msg.sender, id)\\n{\\n    STypes.ShortRecord storage short = s.shortRecords[asset][msg.sender][id];\\n    short.updateErcDebt(asset);\\n    if (amount > short.collateral) revert Errors.InsufficientCollateral();\\n    short.collateral -= amount;\\n❌  uint256 cRatio = short.getCollateralRatio(asset);\\n    if (cRatio < LibAsset.initialMargin(asset)) {\\n        revert Errors.CollateralLowerThanMin();\\n    }\\n    uint256 vault = s.asset[asset].vault;\\n    s.vaultUser[vault][msg.sender].ethEscrowed += amount;\\n    LibShortRecord.disburseCollateral(\\n        asset, msg.sender, amount, short.zethYieldRate, short.updatedAt\\n    );\\n    emit Events.DecreaseCollateral(asset, msg.sender, id, amount);\\n}\\n```\\n\\nThe called `getCollateralRatio` function uses the `LibOracle.getPrice` function to calculate the collateral ratio:\\n```\\nfunction getCollateralRatio(STypes.ShortRecord memory short, address asset)\\n    internal\\n    view\\n    returns (uint256 cRatio)\\n{\\n    return short.collateral.div(short.ercDebt.mul(LibOracle.getPrice(asset)));\\n}\\n```\\n\\nThe `LibOracle.getPrice` function returns the currently cached asset price, which potentially is older than 15 minutes.\\n```\\nfunction getPrice(address asset) internal view returns (uint80 oraclePrice) {\\n    AppStorage storage s = appStorage();\\n    return uint80(s.bids[asset][Constants.HEAD].ercAmount);\\n}\\n```\\n\\nConsequently, the calculated `cRatio` in line 94 of the `decreaseCollateral` function is based on the potentially outdated asset price, resulting in the collateral ratio being inaccurate and diverging from the actual collateral ratio based on the current asset spot price.\\nA short owner can exploit this by decreasing the short's collateral up to the point where the resulting collateral ratio is equal to the initial margin (i.e., 500%). As the collateral ratio, `cRatio`, is calculated in line 94 based on the outdated cached oracle price, the short owner can withdraw more collateral than the actual collateral ratio (based on the asset spot price) would allow.\\nSimilarly, the `increaseCollateral` function is affected as well.
Consider using the `LibOracle.getSavedOrSpotOraclePrice` function together with the `getCollateralRatioSpotPrice` function to calculate the collateral ratio based on the current asset price.
Short-position owners can withdraw more collateral than eligible, negatively affecting the overall asset's collateral ratio.
```\\nfunction decreaseCollateral(address asset, uint8 id, uint88 amount)\\n    external\\n    isNotFrozen(asset)\\n    nonReentrant\\n    onlyValidShortRecord(asset, msg.sender, id)\\n{\\n    STypes.ShortRecord storage short = s.shortRecords[asset][msg.sender][id];\\n    short.updateErcDebt(asset);\\n    if (amount > short.collateral) revert Errors.InsufficientCollateral();\\n    short.collateral -= amount;\\n❌  uint256 cRatio = short.getCollateralRatio(asset);\\n    if (cRatio < LibAsset.initialMargin(asset)) {\\n        revert Errors.CollateralLowerThanMin();\\n    }\\n    uint256 vault = s.asset[asset].vault;\\n    s.vaultUser[vault][msg.sender].ethEscrowed += amount;\\n    LibShortRecord.disburseCollateral(\\n        asset, msg.sender, amount, short.zethYieldRate, short.updatedAt\\n    );\\n    emit Events.DecreaseCollateral(asset, msg.sender, id, amount);\\n}\\n```\\n