The current implementation of the GMXVault.sol sets the address of the ExchangeRouter(which is the core entry point of the SteadeFi for GMX) only in the constructor, which is stated as an integration issue in the GMX’s readme:
• If using contracts such as the ExchangeRouter, Oracle or Reader do note that their addresses will change as new logic is added
https://github.com/gmx-io/gmx-synthetics#integration-notes
The vulnerability lies in the fact that usually when a new ExchangeRouter is deployed from the GMX, the old router will not be used and funds have to be migrated to the newly deployed one.
Historically GMX is evolving daily and breaking changes in one of their core components will not be a surprise.
The fact that this issue is stated explicitly in their README means that it will definitely affect the existing markets, but the thing that matters is that the whole balance of the market will be migrated to the new ExchangeRouter, which will make the existing GMXVaults that use the old router hardcoded at the constructor useless: store.exchangeRouter
.
That will result in the inability of all depositors of the GMXVault to withdraw their funds.
Stuck user funds due to the old ExchangeRouter not pointing to the right helper libraries: DepositUtils, WithdrawalUtils, and DataStore, which are all tied to the currently set ExchangeRouter in the constructor of the GMXVault, making it impossible for the users of the protocol to withdraw their funds.
Manual, GMX GitHub
Consider adding a function that allows changing the addresses of the core GMX contracts used:
Impact: High Likelihood: Low
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.