Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

getLpTokenAmount is called with isDeposit=False for Deposit

Citris

Summary

getLpTokenAmount is called with isDeposit=False for Deposit

In GMXOracle, the function getLpTokenValue, together with the slippage input from user, is used to calculate the expected lp token output in many interactions. (including deposit and withdrawal). It makes use of a toggle isDeposit to indicate the pnlFactorType and pass it ultimately to the GMX native method in syntheticReader.getMarketTokenPrice.

However, during the call getLpTokenValue in GMXDeposit library, the call is done with isDeposit = false

GMXDeposit.sol

...
// If LP token deposited
_dc.depositValue = self.gmxOracle.getLpTokenValue(
address(self.lpToken),
address(self.tokenA),
address(self.tokenA),
address(self.tokenB),
false,
false
)

https://github.com/Cyfrin/2023-10-SteadeFi/blob/main/contracts/strategy/gmx/GMXDeposit.sol#L97

function getLpTokenValue(
address marketToken,
address indexToken,
address longToken,
address shortToken,
bool isDeposit,
bool maximize
) public view returns (uint256) {
bytes32 _pnlFactorType;
​
if (isDeposit) {
_pnlFactorType = keccak256(abi.encode("MAX_PNL_FACTOR_FOR_DEPOSITS"));
} else {
_pnlFactorType = keccak256(abi.encode("MAX_PNL_FACTOR_FOR_WITHDRAWALS"));
}
​
(int256 _marketTokenPrice,) = getMarketTokenInfo(
marketToken,
indexToken,
longToken,
shortToken,
_pnlFactorType,
maximize
);
​
// If LP token value is negative, return 0
if (_marketTokenPrice < 0) {
return 0;
} else {
// Price returned in 1e30, we normalize it to 1e18
return uint256(_marketTokenPrice) / 1e12;
}
}

From the design of GMXVault, keeper or the

Vulnerability Details

Impact

the expected lp amount would be inaccurate for deposit.

Tools Used

Recommendations

correctly pass in isDeposit = True for GMXDeposit.

Updates

Lead Judging Commences

hans Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.