Steadefi

Summary

GmxVault.updateFeePerSecond should accrue fee first, as otherwise new rate will be applied to previous time.

Vulnerability Details

GMXVault stakers pay management fee to the protocol. This fee is paid for each second using _store.feePerSecond rate. And this rate can be changed by protocol. Once it's done, then mintFee function will use new value as fee rate. Because of that, mintFee should be called right before fee rate changing, so then there can be no situation when new rate is applied to past time.

Impact

Fee payment may be wrong.

Tools Used

VsCode

Recommendations

Call mintFee before changing fee rate.