Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The protocol locking due to revert on native tokens

pontifex

Summary

In case a user can't or doesn't want to receive native tokens (even as malicious behavior), the protocol stays in the Deposit or Withdraw status and the only way to change the status is the emergency procedures with full liquidity removal.

Vulnerability Details

There is functionality for sending native token to untrusted addresses at the GMXDeposit and GMXWithdraw libs.
GMXDeposit.processDepositCancellation:

function processDepositCancellation(
​
​
if (self.depositCache.depositParams.token == address(self.WNT)) {
self.WNT.withdraw(self.WNT.balanceOf(address(this)));
(bool success, ) = self.depositCache.user.call{value: address(this).balance}("");
require(success, "Transfer failed.");

GMXWithdraw.processWithdraw:

function processWithdraw(
​
​
if (self.withdrawCache.withdrawParams.token == address(self.WNT)) {
self.WNT.withdraw(self.withdrawCache.tokensToUser);
(bool success, ) = self.withdrawCache.user.call{value: address(this).balance}("");
require(success, "Transfer failed.");

In case of false in these calls the protocol stays in the Deposit or Withdraw status and business functionality becomes blocked. Users can revert on all native tokens as malicious behavior.

Impact

The protocol functionality can be blocked.

Tools used

Manual Review

Recommendations

Consider in case of success != true wrapping native tokens and transferring them as usual instead of reveret.

Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

DOS by rejecting native token

Impact: High Likelihood: High An attacker can repeatedly force the protocol to get stuck in a not-open status. This can happen on both deposit, withdraw callback for both successful execution and failures. Will group all similar issues.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.