Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Gmx position size is not completely validated

bladesec

Title

Gmx position size is not completely validated

Summary

The _createIncreasePosition function in PerpetualVault.sol doesn't properly check if a position size matches gmx market limits. This can cause orders to fail partway, waste fees, and lock up funds because the system doesn't validate sizes before sending them to gmx.

Vulnerability Details

The current code calculates position size without checking if it fits within gmx's open interest limits or if there's enough liquidity.

File: f:\hans\contest\codehawks\2025-02-gamma\contracts\PerpetualVault.sol
872: IGmxProxy.OrderData memory orderData = IGmxProxy.OrderData({
873: market: market,
874: indexToken: indexToken,
875: initialCollateralToken: address(collateralToken),
876: swapPath: new address[](0),
877: isLong: _isLong,
878: sizeDeltaUsd: sizeDelta, //@audit-issue no validation
879: initialCollateralDeltaAmount: 0,
880: amountIn: amountIn,
881: callbackGasLimit: callbackGasLimit,
882: acceptablePrice: acceptablePrice,
883: minOutputAmount: 0
884: });

Impact

The lack of position size validation can lead to partial order execution.

Tools Used

Manual Review

Recommended Mitigation

Validate position size against GMX market limits.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.