Steadefi

Summary

The fields used to authorize valid callback calls are publicly accessible. This allows malicious actors to bypass validation checks by crafting fake callback calls.

Vulnerability Details

Structs like Store contain public fields like depositCache and withdrawCache in GMXCallback.sol contract. These fields hold deposit/withdraw keys used to validate the target of callbacks. As the keys are public, anyone can construct a fake callback call with arbitrary keys. This circumvents the internal validation checks meant to authorize only real callback events.

Impact

Malicious actors can spoof callback events that should not be processed.

Tools Used

Manual Review

Recommendations

Make authorization data private to only be accessible within the contract.