Liquidity Management

Summary

User is over charged for transaction when the user deposits into gamma due to over estimation of gas required at gmx

Vulnerability Details

When interacting with GMX contract, to make an execution , the vault has to estimate what the gas cost are each time, using fixed estimation values from GMX contract fetched in Perpetual#getExecutionGasLimit. The ExecutionGasLimit cost is divided into three variables: baseGasLimit, callbackGasLimit & estimatedGasLimit.

BaseGasLimit is calculated as so:

oraclePriceCount is used to multiply the oracle price, and the oracle count has a fixed value of 5, this should not be the case,

as in GMX the oracle count is not fixed but a cumulative of a fixed and variable value.

https://github.com/gmx-io/gmx-synthetics/blob/b8fb11349eb59ae48a1834c239669d4ad63a38b5/contracts/gas/GasUtils.sol#L228C4-L237C1

When estimating oracle price count, it is seen that the only fixed value on GMX is 3 and then the variable value “swapCount” is dependent on what is supplied from Gamma contracts on interaction with GMX. SwapPath, as defined in perpetualvault, is always zero except when the keeper wants to run an actual swap, but it is zero for increaseORder and decreaseOrder order types. Also keep in mind that the keeper determines the swappath in metadata param passed to the run function, so the contract is ignorant of the length of path.

IncreasePosition:

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/PerpetualVault.sol#L876

DecreasePosition

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/PerpetualVault.sol#L906

Settle:

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/PerpetualVault.sol#L954

GMX Swap

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/PerpetualVault.sol#L1069

Impact

Gas fees are over estimated and thus more funds taken from the user.

Tools Used

manual

Recommendations

Implement oracle count as is applicable to GMX using both fixed and variable value.