Liquidity Management

Summary

Native ETH can be sent to the account address in case of Liquidations or ADL per GMX documentation (https://github.com/gmx-io/gmx-synthetics#Integrations). However, the callback function afterOrderExecution on GmxProxy.sol does not handle the case of native token being sent.

Vulnerability Details

afterOrderExecution function is responsible for handling the callbacks from GMX. In case of any tokens being sent to the GmxProxycontract by GMX, it is transferred to the PerpetualVault contract via the logic of the callback function. However, the logic only supports ERC20 transfers but not native token transfers. This will lead to a situation where the callback call will revert as a result of trying to transfer ERC20 that does not exist or the amount that does not exist(it depends on what the GMX will use as the place holder for native ETH in the eventData.addressItems.items.valuefield). Which in the end will break the flow of the protocol at certain situations due to the end of the call not reaching PerpetualVault.afterLiquidationExecution().

Impact

Broken flow of the protocol due to the callback on PerpetualVault.afterLiquidationExecution()not being triggered potentially leading to DOS. Protocol flow may not be aware whether the position was liquidated or full size reduction was carried out by ADL. The ETH sent to the contract may be partially lost if it is used as the posititionExecutionFee before the protocol manually transfers them out.

Tools Used

Manual review.

Recommendations

Validate the addresses of the tokens sent inside the afterOrderExecution logic and handle the reverts with try catch blocks.