Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`IExchangeRouter#CreateDepositParams#uiFeeReceiver` set in a manor that will cause some users to miss out on claiming fees

NeverGonnaGiveYulUp

Summary

The current implementation sets the uiFeeReceiver (fee charged on GMX) to the msg.sender. This can cause smart contracts integrating with Steadefi to lose funds if they are not able to claim the uiFee.

Vulnerability Details

When adding or removing liquidity to GMX the uiFeeReceiver is set to self.refundee (which is always the msg.sender):

// Create deposit
IExchangeRouter.CreateDepositParams memory _cdp =
IExchangeRouter.CreateDepositParams({
...
uiFeeReceiver: self.refundee,

The intention here is to not pay any uiFees to GMX. However, uiFees are not paid automatically, but have to be claimed manually (using ExchangeRouter.claimUiFees). This is not only inconvenient for users, but also might cause the uiFee-amount to be lost, due to users being smart contracts that integrate with Steadify, but did not consider this subtle mechanism.

Impact

Loss of funds equal to the uiFeeAmount that GMX would charge

Tools Used

Manual Review

Recommendations

Set IExchangeRouter#CreateDepositParams#uiFeeReceiver to address(0), this will cause no uiFee to be charged as can be seen in PositionPricingUtils from GMX

function getUiFees(
DataStore dataStore,
Price.Props memory collateralTokenPrice,
uint256 sizeDeltaUsd,
address uiFeeReceiver
) internal view returns (PositionUiFees memory) {
PositionUiFees memory uiFees;
​
if (uiFeeReceiver == address(0)) {
return uiFees;
}
Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong usage of uiFeeReceiver

Impact & Likelihood: High https://gmx-docs.io/docs/api/contracts-v2#creating-a-withdrawal

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.