Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

GMXOracle.sol#L280: function `getLpTokenAmount` icorrectly assumes that the returned price is in 18 decimal places. But it is 30 decimal places.

ak1

Summary

GMXOracle oracle has a function getLpTokenAmount which is in scope. This is Used in keeper script to calculate how much LP tokens for given USD value.

This function returns the lpTokenAmount with 30 decimal places instead of 18 as the function assumes.

Vulnerability Details

Lets look at the function getLpTokenAmount

/**
* @notice Get token A and token B's LP token amount required for a given value
* @param givenValue Given value needed, expressed in 1e30 -------------------------->> refer this
* @param marketToken LP token address
* @param indexToken Index token address
* @param longToken Long token address
* @param shortToken Short token address
* @param isDeposit Boolean for deposit or withdrawal
* @param maximize Boolean for minimum or maximum price
* @return lpTokenAmount Amount of LP tokens; expressed in 1e18 -------------->>> refer this
*/
function getLpTokenAmount(
uint256 givenValue,
address marketToken,
address indexToken,
address longToken,
address shortToken,
bool isDeposit,
bool maximize
) public view returns (uint256) {
uint256 _lpTokenValue = getLpTokenValue(
marketToken,
indexToken,
longToken,
shortToken,
isDeposit,
maximize
);
​
​
return givenValue * SAFE_MULTIPLIER / _lpTokenValue;
}

SAFE_MULTIPLIER is in 18 decimal places.

The values returned from the function _lpTokenValue is in 18 decimal places. Refer the line

So the final returned value from the function getLpTokenAmount is (1e30 * 1e18) / 1e18 = 1e30

Impact

Overestimating the lpToken amount for the given USD value.

Tools Used

Manual review.

Recommendations

Update the function getLpTokenAmount as shown below.

function getLpTokenAmount(
uint256 givenValue,
address marketToken,
address indexToken,
address longToken,
address shortToken,
bool isDeposit,
bool maximize
) public view returns (uint256) {
uint256 _lpTokenValue = getLpTokenValue(
marketToken,
indexToken,
longToken,
shortToken,
isDeposit,
maximize
);
​
return givenValue * SAFE_MULTIPLIER / _lpTokenValue; ------>> remove
​
return (givenValue * SAFE_MULTIPLIER) / (_lpTokenValue * 1e12); ---->> add
}
Updates

Lead Judging Commences

hans Auditor
almost 2 years ago
hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong decimal in getLpTokenAmount

Impact: Low This is a view function and the impact is very limited because there is no direct usage of this function in other functions.

ak1 Submitter
almost 2 years ago
hans Auditor
almost 2 years ago
ak1 Submitter
almost 2 years ago
hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong decimal in getLpTokenAmount

Impact: Low This is a view function and the impact is very limited because there is no direct usage of this function in other functions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.