DeFiFoundry
50,000 USDC
View results
Submission Details
Severity: low
Invalid

Giving approval to the wrong address in `GmxProxy::createOrder()`

Summary

In GmxProxy::createOrder(), we are giving the wrong address approval as can be seen [here](https://github.com/CodeHawks-Contests/2025-02-gamma/blob/main/contracts/GmxProxy.sol#L406-L414).

We give approval to gmxRouter, even though in the next line we call gExchangeRouter, and making it impossible to actually create an order, so a revert will happen.

Impact

Revert because an unapproved address will be used for swapping funds, which is obviously wrong

Tools Used

Recommendations

Approve the correct address - gExchangeRouter

Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

invalid_approval_gmxRouter_instead_of_gExchangeRouter

Router is the one collecting tokens: https://github.com/gmx-io/gmx-synthetics/blob/caf3dd8b51ad9ad27b0a399f668e3016fd2c14df/contracts/router/BaseRouter.sol#L46 https://github.com/gmx-io/gmx-synthetics/blob/caf3dd8b51ad9ad27b0a399f668e3016fd2c14df/contracts/router/Router.sol#L27

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.