Steadefi

Summary

keepers map is not updated when updating the callback function by calling the function updateCallback.

Vulnerability Details

GMXVault contract has the keepers map who is approved to carry out core functionality such as deposit, withdraw, rebalance and compound.

The keepers map is updated while deploying the vault contract. refer the line. Here the callback is set as keeper.

This callback can be updated later by calling the function updateCallback.

when we see this updateCallback function, it misses to update the keeper map.

Though there is another function updateKeeper to update this, missing the updateKeeper function call from updateCallback could be cause of concern if it is missed.

Impact

An outdated or removed keeper still can control the core functionality such as deposit, withdraw , rebalance etc.

Tools Used

Manual review.

Recommendations

Update the function updateCallback as shown below.