Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`processDepositCancellation()` doesn't handle GMX periods of no deposit cacellation

Obin

Summary

Function processDepositCancellation() doesn't handle edge case.

Vulnerability Details

In integrating Protocol (GMX) there exists a request cancellation period for a few blocks where deposit requests cannot be cancelled.
The check GMXChecks.beforeProcessDepositCancellationChecks(self); is insufficent and only checks if status is Deposit. see check below:

function beforeProcessDepositCancellationChecks(
GMXTypes.Store storage self
) external view {
if (self.status != GMXTypes.Status.Deposit)
revert Errors.NotAllowedInCurrentVaultStatus();
}

Impact

A User who requests deposit cancellation may experience unexpected / unexplained DOS

Tools Used

Manual review

Recommendations

  1. Include a check for this edge case in beforeProcessDepositCancellationChecks()

  2. Or wrap the function processDepositCancellation() in a try-catch method.

Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.