Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Updated management fees may apply retroactively

pontifex

Summary

The GMXValue.updateFeePerSecond function changes the management fees without first charging the fees for the previous period. So when the mintFee function is called next time the fees will be charged with the new feePerSecond value for both periods before and after updating.

Vulnerability Details

The GMXValue.updateFeePerSecond function updates the management fee per second. In case mintFee was not called right before the new management fees will be later applied retroactively.

function updateFeePerSecond(uint256 feePerSecond) external onlyOwner {
_store.feePerSecond = feePerSecond;
emit FeePerSecondUpdated(feePerSecond);
}

Impact

Updated management fees may apply retroactively.

Tools used

Manual Review

Recommendations

Consider calling mintFee before feePerSecond updating:

function updateFeePerSecond(uint256 feePerSecond) external onlyOwner {
+ mintFee();
_store.feePerSecond = feePerSecond;
emit FeePerSecondUpdated(feePerSecond);
}
Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Mint remaining fee first on updateFeePerSecond

Severity: High Likelihood: Low

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.