Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect PNL Factor Leads to Inaccurate Token Value Calculation

ro1sharkm

Summary

The vulnerability in the GMXDeposit contract arises from the incorrect use of Profit and Loss (PNL) factors, which leads to inaccurate token value calculations. Specifically, the contract incorrectly sets the isDeposit parameter to false, causing it to utilize the PNL factor intended for withdrawals. As a result, users receive token values that do not conform to the intended risk parameters, which can mislead and impact their decisions regarding token holdings.

Vulnerability Details

The vulnerability originates from a misalignment in the GMXDeposit contract's use of PNL factors for token value calculation. Within the getLpTokenValue() function, the isDeposit parameter is erroneously set to false, which triggers the usage of the PNL factor designated for withdrawals. The code snippet below illustrates the incorrect utilization:

_dc.depositValue = self.gmxOracle.getLpTokenValue(
address(self.lpToken),
address(self.tokenA),
address(self.tokenA),
address(self.tokenB),
false,
false
)
function getLpTokenValue(
address marketToken,
address indexToken,
address longToken,
address shortToken,
bool isDeposit,
bool maximize
) public view returns (uint256) {
bytes32 _pnlFactorType;
​
​
if (isDeposit) {
_pnlFactorType = keccak256(abi.encode("MAX_PNL_FACTOR_FOR_DEPOSITS"));
} else {
_pnlFactorType = keccak256(abi.encode("MAX_PNL_FACTOR_FOR_WITHDRAWALS"));
}
​
​
(int256 _marketTokenPrice,) = getMarketTokenInfo(
marketToken,
indexToken,
longToken,
shortToken,
_pnlFactorType,
maximize
);

Impact

The use of an incorrect PNL factor results in token values that do not conform to the intended risk parameters.

Tools Used

Manual analysis

Recommendations

Review and update the code to ensure that the correct PNL factor, whether for deposits or withdrawals, is consistently applied in token value calculations.

Updates

Lead Judging Commences

hans Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong PNL Factor in GMXDeposit for for lpToken

Impact: Medium Likelihood: High The impact of using a wrong price (conservative vs optimistic) is limited, especially given the users specify the slippage.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.