Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

MarketIncrease and MarketDecrease order should not require gas for swaps.

pkqs90

Summary

MarketIncrease and MarketDecrease order should not require gas for swaps.

Vulnerability Details

When calculating the amount of gas fees the user need to deposit into gmxProxy, an extra gasPerSwap is calculated for MarketIncrease and MarketDecrease orders. Since we always set swapPath to empty when creating orders, there will be no swaps performed, hence this gas fee is not required.

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/main/contracts/GmxProxy.sol#L155

function getExecutionGasLimit(
Order.OrderType orderType,
uint256 _callbackGasLimit
) public view returns (uint256 executionGasLimit) {
uint256 baseGasLimit = dataStore.getUint(
ESTIMATED_GAS_FEE_BASE_AMOUNT_V2_1
);
uint256 oraclePriceCount = 5; // maximum number of oralce prices
baseGasLimit +=
dataStore.getUint(ESTIMATED_GAS_FEE_PER_ORACLE_PRICE) *
oraclePriceCount;
uint256 multiplierFactor = dataStore.getUint(
ESTIMATED_GAS_FEE_MULTIPLIER_FACTOR
);
uint256 gasPerSwap = dataStore.getUint(SINGLE_SWAP_GAS_LIMIT);
uint256 estimatedGasLimit;
if (orderType == Order.OrderType.MarketIncrease) {
estimatedGasLimit =
dataStore.getUint(INCREASE_ORDER_GAS_LIMIT) +
@> gasPerSwap;
} else if (orderType == Order.OrderType.MarketDecrease) {
estimatedGasLimit =
dataStore.getUint(DECREASE_ORDER_GAS_LIMIT) +
@> gasPerSwap;
}...
// multiply 1.2 (add some buffer) to ensure that the creation transaction does not revert.
executionGasLimit =
baseGasLimit +
((estimatedGasLimit + _callbackGasLimit) * multiplierFactor) /
PRECISION;
}

Impact

Users pay extra gas fee.

Tools Used

N/A

Recommendations

Remove gasPerSwap for MarketIncrease and MarketDecrease orders.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.