POSSIBLE_PROTOCOL_BLOCKAGE_IF_USER_CALL_REVERTS
Summary
Functions can be blocked if contact with revert in fallback function is called
Vulnerability Details
GMXWithdraw.processWithdraw and GMXDeposit.processDepositCancellation require call to user to be success: require(success, "Transfer failed.");. If called a contract with revert in a fallback function, this functions can be blocked
Impact
Blocked GMXDeposit.processDepositCancellation and status changing. Blocked GMXWithdraw.processWithdraw
Tools Used
Recommendations
Consider to allow failure or add flag that allows to ignore failures
Lead Judging Commences
DOS by rejecting native token
Impact: High Likelihood: High An attacker can repeatedly force the protocol to get stuck in a not-open status. This can happen on both deposit, withdraw callback for both successful execution and failures. Will group all similar issues.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.