Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

users may not get refunded if sending `ETH` to them fail

ElHaj

Summary

  • users may not get refunded if sending eth their address fail.

Vulnerability Details

  • Users send ETH known as executionFee along with their call to the strategy.to cover their actions due to GMX's two-step mechanism.

  • After the GMX keeper executes the second transaction, it refunds the remaining executionFee to the receiver (in our case, GMXVault strategy).

  • GMXVault then attempts to send received ETH to the user (refundee address).

receive() external payable {
if (msg.sender == _store.depositVault || msg.sender == _store.withdrawalVault) {
(bool success,) = _store.refundee.call{value: address(this).balance}("");
require(success, "Transfer failed.");
}
}

  • The issue arises if sending ETH to the user fails; GMX sends WETH to the contract instead. In this case, the strategy contract fails to refund the user, leaving the WETH stuck in the GMXVault contract.

Impact

  • users may not get refunded .

Tools Used

vs code
manual review

Recommendations

  • implement the same logic like gmx if sending eth fail , send weth instead:

receive() external payable {
if (msg.sender == _store.depositVault || msg.sender == _store.withdrawalVault) {
try this.sendEth() {
​
}catch {
_store.WNT.deposit{value:address(this).balance}();
_store.WNT.transfer(_store.refundee,_store.WNT.balanceOf(address(this)));
}
}
}
function sendEth() external onlyVault {
(bool success,) = _store.refundee.call{value: address(this).balance}("");
require(success, "Transfer failed.");
}
Updates

Lead Judging Commences

hans Auditor
almost 2 years ago
hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

DOS by rejecting native token

Impact: High Likelihood: High An attacker can repeatedly force the protocol to get stuck in a not-open status. This can happen on both deposit, withdraw callback for both successful execution and failures. Will group all similar issues.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.