Steadefi

Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Submission Details
Severity: medium
Valid

Min Execution fee can cause Vault to be temp dossed.

Summary

Transactions might be temporarily doxxed cause of method used to calculate the expected execution fee for a trasaction.

Vulnerability Details

In GMX contracts, the execution fee is expected to be a floating variable calculated on the fly when a transaction is processed, while on the vault contract, execution fee is a fixed unchangeable value. The Vault should rather call the gmx contract cause the chian itself might become more expensive than envisaged by the vaults and thus the price for fees get higher than the minimum value in the vault, this will lead to an increase in expected fees on the gmx contract, but not on the vault, which will lead to a dos.

Impact

Dox transactions on the vault contract.

Tools Used

Manual.

Recommendations

Use the same mechanism to calculate fees as used in the gmx contract or call the gmx contract directly for fees.

Updates

Lead Judging Commences

hans Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Hardcoded gas for callback execution

Impact: High Likelihood: Low GMX can change the MAX_CALLBACK_GAS_LIMIT to lower than 2m.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.