Title

Unaddressed nextAction state after Signal_CHANGE cancellation

Summary

When a decrease order fails during position closure and reopening, the nextAction isn't reset. This violates the system's invariant that expects nextAction to be empty after all actions are completed.

Vulnerability Details

1. A leveraged position on GMX is being closed and a new one opened.

2. The keeper triggers the run() function, leading to the else block at lines 314-325:

   nextAction.selector = NextActionSelector.INCREASE_ACTION;

   nextAction.data = abi.encode(isLong);

   This schedules the next action as INCREASE_ACTION.

3. During _createDecreasePosition(), a MarketDecrease order is created, but it fails on GMX.

4. The keeper cancels the order, triggering afterOrderCancellation(), which resets flow and flowData but doesn't clear nextAction.

Impact

The nextAction remains set to INCREASE_ACTION, breaking the invariant that it should be empty after all actions.

Tools Used

Manual Review

Recommendations

Modify the afterOrderCancellation() function to reset nextAction when flow is SIGNAL_CHANGE.