Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unimplemented frozen order handler in GmxProxy contract

bladesec

Title

Unimplemented frozen order handler in GmxProxy contract

Summary

The afterOrderFrozen function in the GmxProxy contract is empty, which means frozen orders aren't removed from the queue. This can cause the system to malfunction and potentially lead to denial-of-service attacks.

Vulnerability Details

The afterOrderFrozen function is currently empty and doesn't handle frozen orders properly:

function afterOrderFrozen(
bytes32 key,
Order.Props memory order,
EventLogData memory
) external override validCallback(key, order) {}

This means when an order is frozen on the GMX protocol, the order stays active in the queue without updating the requestKey or cleaning up the queue. The validCallback modifier only checks the caller and account but doesn't verify the order's status in the queue or if it was previously frozen.

modifier validCallback(bytes32 key, Order.Props memory order) {
require(
msg.sender == address(orderHandler) ||
msg.sender == address(liquidationHandler) ||
msg.sender == address(adlHandler),
"invalid caller"
);
require(order.addresses.account == address(this), "not mine");
_;
}

This lack of validation can cause frozen orders to remain active, potentially disrupting the system.

Impact

Frozen orders stay active in the system

Tools Used

Manual Review

Recommendations

The afterOrderFrozen function should be updated to remove the frozen order from the queue if it matches the current order.

Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.