Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Inadequate Leverage Check in cancelFlow Function

kkk

Summary

The cancelFlow function in the PerpetualVault contract allows the cancellation of an ongoing flow even when the vault operates with 1x leverage. There is no check in place to prevent cancellation under 1x leverage conditions, which may lead to unintended behavior in low-risk scenarios.

Vulnerability Details

function cancelFlow() external nonReentrant gmxLock {
_onlyKeeper();
_cancelFlow();
}

• The function is callable by the keeper without any leverage-specific restrictions.

• The absence of a leverage check means that flows can be cancelled regardless of whether the vault is operating at 1x leverage.

Impact

• Operational Ambiguity: Users and operators might face unexpected cancellation of flows, potentially leading to state inconsistencies if the vault is intended to be locked at 1x leverage.

• Low Severity: The issue is classified as low severity since it does not directly result in fund loss or exploitability; however, it could lead to operational confusion.

Tools Used

Manual

Recommendations

• Implement Leverage Check:

Add an explicit check to ensure that the cancelFlow function cannot be executed when the vault is operating at 1x leverage if such cancellation is not desired.

+ require(leverage != BASIS_POINTS_DIVISOR, "Cannot cancel 1x long leverage");
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.