Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Recipient and Amount in Refund Execution Fee

0xnforcer

Summary

In the PerpetualVault::_handleReturn function, the code mistakenly calls refundExecutionFee using depositInfo[counter] instead of depositInfo[depositId]. This results in refunding the wrong caller address and amount when the deposit being withdrawn is not the most recent deposit (counter).

Vulnerability Details

Instead of using depositInfo[depositId].owner and depositInfo[depositId].executionFee - usedFee, the function references depositInfo[counter], causing potential misdirection of the refund.
When a user withdraws with depositId ≠ counter, they will not receive the correct refund, and another (last) depositor might inadvertently receive it. This can lead to loss of funds for the withdrawing user.

Here is the code snippet that is vulnerable:

if (depositInfo[depositId].executionFee > usedFee) {
try IGmxProxy(gmxProxy).refundExecutionFee(depositInfo[counter].owner, depositInfo[counter].executionFee - usedFee) {} catch {} //audit - using counter instead of depositId
}

Impact

Funds intended for the user making the withdrawal can be incorrectly sent to the user who made the most recent deposit. This causes a direct financial loss for the withdrawing user and an unexpected gain for the last depositor.

Tools Used

Manual Review

Recommendations

Replace the usage of depositInfo[counter] with depositInfo[depositId] when calling refundExecutionFee. For example:

if (depositInfo[depositId].executionFee > usedFee) {
try IGmxProxy(gmxProxy).refundExecutionFee(depositInfo[depositId].owner, depositInfo[depositId].executionFee - usedFee) {} catch {}
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_counter_invalid_during_handleReturn

Likelihood: Medium/High, when withdraw on a 1x vault. Impact: High, the fees will be distributed to the last depositor and not the withdrawer.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.