Summary

Protocol implicitly doesn't support tokens with more than 18 decimals

Vulnerability Details

If in function convertToUsdValue token that is converted to USD value has more than 18 decimals, subtraction 18 - IERC20Metadata(token).decimals() will fail

Token decimals are not checked in GMXVault.deposit, GMXDeposit.deposit, ...

Impact

Blockage for pairs with more than 18 decimals

Tools Used

Recommendations

Explicitly prohibit addition of tokens with more than 18 decimals. Assert correct decimals in convertToUsdValue and in functions that add tokens used later with convertToUsdValue. Consider to implement support for tokens with more than 18 decimals