Steadefi

Summary

The GMX callback functions do not validate the msg.sender address, relying only on the GMX system to call from expected sources. This could allow spoofing of valid callback calls.

Vulnerability Details

In functions like afterDepositExecution(), no check is made that msg.sender actually corresponds to the GMX controller/handler contract.

An attacker could potentially craft a transaction from any address calling these functions directly.As written, there is nothing stopping a spoofing attack where callbacks are falsely triggered in situations they should not be.

Impact

A spoofing attack could allow triggering vault state transitions out of expected ordering. This risks fund security.
Invalid status updates may occur if callback requirements aren't correctly met due to spoofing. Over time, desynchronization between on-chain state and real-world orders/fills could result from spoofed callbacks affecting auditability.

Tools Used

Manual Review

Recommendations

Validate msg.sender corresponds to expected GMX controller by address or signature or Integrate callback source validation as part of general vault state transition management.