Submission Details
Severity:
Excess eth is not refunded
Summary
The deposit of GMXDeposit supports sender in providing eth(msg.value) to be deposted into vault. Now if user has provided more eth than dp.amt then this excess eth is not refunded back to user.
Vulnerability Details
// file: contracts/strategy/gmx/GMXDeposit.sol#L78-L84
if (isNative) {
GMXChecks.beforeNativeDepositChecks(self, dp);
self.WNT.deposit{ value: dp.amt }(); // @audit check if msg.value > dp.amt , and refund to user
} else {
IERC20(dp.token).safeTransferFrom(msg.sender, address(this), dp.amt); // @audit check if value is 0
}
Impact
The remaining ETH is not refunded to the user.
Tools Used
Manual Review
Recommendations
At the end of deposit function, refund the remaining eth back to the user.
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915
USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.