Submitted by immeas, also found by 0xBeirao, kaden, ast3ros, cccz and ladboy233.
When opening a position, the user makes a deposit and takes a loan against this on the Rubicon compound fork. This loan is taken using max liquidity:
https://github.com/code-423n4/2023-04-rubicon/blob/main/contracts/utilities/poolsUtility/Position.sol#L306-L319
The danger here, is the interest rate for a loan needs to be higher than the interest for the deposit of the collateral. Hence, the block after the loan is taken it will be under water.
Positions opened will, in the block after they are created, become under water and be possible to liquidate.
This only impacts a certain set of leverages (shorts 1x, longs 1.7x and so on) where you loan up to your collateral max; hence, medium severity.
A user will have to know about this behavior in Position and in the same tx (to be safe) increase their margin to not be vulnerable to liquidation.
PoC test, PositionTest.t.sol:
closeFactor and liquidationIncentive is the same as compound on mainnet.
Added a mint function in the TokenWithFaucet:
Manual audit, forge
Introduce a safety factor to scale the loans, which the user can provide when opening the position.
daoio (Rubicon) confirmed via duplicate issue #827
HickupHH3 (judge) increased severity to High and commented:
