DeFiFoundry
50,000 USDC
View results
Submission Details
Severity: low
Invalid

[L-1] `getPositionFeeUsd` doesn’t cover all fees (borrowing, funding), causing minor pre-calculation errors

[L-1] getPositionFeeUsd doesn’t cover all fees (borrowing, funding), causing minor pre-calculation errors

Description:
The PerpetualVault.sol contract uses vaultReader.getPositionFeeUsd() in afterOrderExecution and _withdraw to calculate GMX position fees for increasing or decreasing positions. However, this function only accounts for the opening/closing position fee (e.g., 0.1% of position size) and does not include borrowing fees (accrued over time based on position duration) or funding rates (periodic payments between long/short positions). These additional fees are handled by GMX during execution but are not pre-adjusted in the contract’s calculations, leading to minor discrepancies between the calculated feeAmount and the actual fees deducted by GMX.

impact:

  • Minor Over/Underestimation: When opening a position (afterOrderExecution), users may receive slightly fewer shares if borrowing fees accrue later and reduce the realized collateral. During withdrawals (_withdraw), users might withdraw less than expected due to unaccounted funding or borrowing fees deducted by GMX, or more if positive funding isn’t pre-included.

  • No Fund Loss: GMX correctly deducts all fees during execution, ensuring no vault shortfall, but the pre-calculation mismatch slightly affects user share issuance or withdrawal amounts.

  • User Experience: Small inaccuracies (e.g., a few USDC) may reduce trust, though the impact is minimal and doesn’t drain the vault.

Proof of Concept:

Recomended Mitigation:

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.