Summary

The GMXCompound contract is vulnerable to a reentrancy attack when users execute compound operations. During the transfer of funds from the trove to the vault, a reentrancy vulnerability could potentially allow other contracts to repeatedly call back into the vault,

Vulnerability Details

-In the compound function, tokens are transferred from the trove to the vault using the safeTransferFrom function. While this operation is expected to be secure, there are no checks or restrictions to prevent reentrant calls.

An attacker can deploy a malicious contract that calls the compound function repeatedly before the token transfer completes. This can create a loop of reentrant calls,

POC

Impact

• Unauthorized Withdrawals: An attacker can repeatedly execute the compound function, potentially withdrawing funds from the vault without proper authorization.

• Financial Losses: Repeated reentrant calls could lead to unintended transfers and financial losses within the vault.

• Disruption: The reentrancy attack can disrupt the normal operation of the GMX protocol, affecting users and the overall stability of the system.

Tools Used

• FOUNDRY

Recommendations

• Use the Checks-Effects-Interactions pattern to ensure that external calls are placed at the end of the function, after all state changes.