Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Misuse of Index Token Price for Long Token Validation in KeeperProxy

sohrabhind

Summary

The contract mistakenly uses indexTokenPrice to validate the price of the long token. This leads to an incorrect comparison when verifying the long token’s price because it references the wrong field (prices.indexTokenPrice instead of a prices.longTokenPrice).

Vulnerability Details

In the _validatePrice function:

_check(marketData.longToken, prices.indexTokenPrice.min);
_check(marketData.longToken, prices.indexTokenPrice.max);

It reuses prices.indexTokenPrice for the long token checks. If longToken is not the same as indexToken, then the long token’s price is never validated properly against its own values.

Impact

Medium

Tools Used

Manual

Recommendations

Fixed code:

_check(marketData.longToken, prices.longTokenPrice.min);
_check(marketData.longToken, prices.longTokenPrice.max);
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_validatePrice_no_check_for_longTokenPrice

Likelihood: None/Very Low, everytime the keeper send a price via run/runNextAction (sent by the Gamma keeper). Impact: Medium/High, does not check the longTokenPrice, it could go out of range. Keep in mind indexToken == longToken, an error from the keeper could be considered informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.