Closed vault should not accrue fee
Summary
In case if GMXVault is closed, then protocol still charges management fee.
Vulnerability Details
GMXVault has management fee that is accrued over time on totalSupply of the vault. This management fee is paid for the protocol to cover some external operations that they do and smth else maybe :).
It also possible that GMXVault is closed. In this case it means that protocol has failed with management, so no fees should be accrued anymore.
However, mintFee function is allowed to be called any time, even if pool is closed already.
Impact
Usuer continue to pay fees for not working vault.
Tools Used
VsCode
Recommendations
When you close Vault, then call mintFee last time. Also do not allow to call mintFee, when vault is closed.
Lead Judging Commences
Disable mintFee during emergency
Impact: High Likelihood: Low Fee calculation must be stopped during an emergency. Typical problem that can happen for pausable protocols.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.