Summary

The contracts GMXDeposit, GMXVault, and GMXWithdraw are vulnerable due to missing validations for the existence of a contract at recipient addresses during Ether transfers via low-level calls.

Vulnerability Details

The vulnerability arises from the use of call{value: address(this).balance}("") without confirming if the destination address hosts a contract. This can lead to Ether being sent to non-contract addresses (like EOAs or the zero address), failing the intended transaction logic and potentially causing financial losses.

Impact

The key impacts include the potential loss of Ether and failure of the intended contract functionalities, such as deposit, refund, or withdrawal operations in the DeFi protocol.

Tools Used

Manual review

Recommendations

• Adding extcodesize checks to confirm the existence of a contract at the recipient address.

• Avoiding low-level calls and preferring high-level contract interactions.

• Implementing zero-address checks as part of the validation process.