Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`emergencyResume()` Protocol does not go for `slippage check` while adding tokens back to `GMXv2`

0xhacksmithh

Summary

emergencyResume() expose to slippage while adding Liquidity to GMXv2. There should be calculation of minAmount market token received while adding liquidity to Market (GMXv2)

Vulnerability Details

There is a function GMXManager.calcMinMarketSlippageAmt() which Calculate minimum market (GM LP) tokens to receive when adding liquidity.
This is implemented in GMXWithdraw.processWithdrawFailure(), https://github.com/Cyfrin/2023-10-SteadeFi/blob/main/contracts/strategy/gmx/GMXWithdraw.sol#L248-L268

Like same it should implemented here as well, before adding liquidity to GMXv2, as it is not emergency anymore. Liquidity will be added when Protocol RESUME when suitable condition appear after PAUSE

function emergencyResume(
GMXTypes.Store storage self
) external {
GMXChecks.beforeEmergencyResumeChecks(self); // if (self.status != GMXTypes.Status.Paused)
​
self.status = GMXTypes.Status.Resume;
​
self.refundee = payable(msg.sender);
​
GMXTypes.AddLiquidityParams memory _alp;
​
_alp.tokenAAmt = self.tokenA.balanceOf(address(this)); // @audit-issue no slippage check when re-adding balance
_alp.tokenBAmt = self.tokenB.balanceOf(address(this));
_alp.executionFee = msg.value;
​
GMXManager.addLiquidity(
self,
_alp
);
}

Impact

Contract may receive less Market Token(Here GM TOKEN) while adding liquidity to Market (GMXv2)

Tools Used

manual review

Recommendations

function emergencyResume(
GMXTypes.Store storage self
) external {
GMXChecks.beforeEmergencyResumeChecks(self);
​
self.status = GMXTypes.Status.Resume;
​
self.refundee = payable(msg.sender);
​
GMXTypes.AddLiquidityParams memory _alp;
​
_alp.tokenAAmt = self.tokenA.balanceOf(address(this));
_alp.tokenBAmt = self.tokenB.balanceOf(address(this));
_alp.executionFee = msg.value;
​
+ // Calculate slippage
+ uint256 _depositValue = GMXReader.convertToUsdValue(
+ self,
+ address(self.tokenA),
+ self.tokenA.balanceOf(address(this))
+ )
+ + GMXReader.convertToUsdValue(
+ self,
+ address(self.tokenB),
+ self.tokenB.balanceOf(address(this))
+ );
​
+ _alp.minMarketTokenAmt = GMXManager.calcMinMarketSlippageAmt(
+ self,
+ _depositValue,
+ slippage
+ );
​
GMXManager.addLiquidity(
self,
_alp
);
}
Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Slippage protection on emergency Pause/Resume

Impact: High Likelihood: Low Because the whole lpToken balance is used during the emergency process, the impact is high. But the likelihood is LOW because of the dependence on the emergency.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.