Submission Details
Severity:
Concurrent Deposits Can Produce Redundant Liquidity
Summary
The addLiquidity() function does not implement any locking mechanisms or checks to prevent duplicate calls adding liquidity concurrently.
Vulnerability Details
If two transactions both call addLiquidity() at the same time, both could succeed, effectively depositing the combined amounts rather than the intended individual amounts.
function addLiquidity(
GMXTypes.Store storage self,
GMXTypes.AddLiquidityParams memory alp
) public returns (bytes32) {
return GMXWorker.addLiquidity(self, alp);
}
Reproduction Steps:
Have two unrelated accounts call addLiquidity() simultaneously
Verify liquidity totals include duplicate amounts
Impact
Actual liquidity levels may exceed recorded amounts
Tools Used
Manual Review
Recommendations
Actual liquidity levels may exceed recorded amounts
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.