DeFiFoundry
50,000 USDC
View results
Submission Details
Severity: low
Invalid

Execution Fee Can Be Drained Due to Lack of Refund Mechanism for Failed Orders

The createOrder function transfers ETH to the GMX order vault to cover the execution fee, but there is no mechanism to refund the fee if the order fails or is canceled. When an order is created, the contract calculates the gas fee required and sends it to GMX:

gExchangeRouter.sendWnt{value: positionExecutionFee}(
orderVault,
positionExecutionFee
);

However, if the order fails (e.g., due to slippage, insufficient liquidity, or GMX execution errors), the execution fee remains locked within the GMX system and is not refunded to the perpetual vault or the proxy contract. This leads to a gradual drain of ETH balance over multiple failed or canceled orders, increasing operational costs and reducing efficiency.

Impact:

The primary impact is a loss of ETH from the contract due to unclaimed execution fee refunds, leading to unnecessary capital inefficiency and potential vault insolvency if excessive fees are lost over time.

Mitigation:

Implement a refund mechanism that calls refundExecutionFee() whenever an order is canceled or fails, ensuring that unused gas fees are returned to the perpetual vault or the proxy.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_no_refund_during_cancellation

Order is not executed, those fees can be used for the next retry.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.