Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Access Control Misconfiguration in setPerpVault Function with Contract Owner

efccweb3

Vulnerability Details

  • Function Affected: setPerpVault

  • Issue Type: Access Control Misconfiguration
    Description:
    The function uses tx.origin to verify if the caller is the owner, which fails when the owner is a contract (GmxProxy.sol).
    The check require(tx.origin == owner(), "not owner"); results in function inaccessibility because tx.origin will always be an external account (EOA) that initiated the transaction, not the contract GmxProxy.sol.

Impact

The setPerpVault function is rendered unusable in its current state since the access check will always fail for GmxProxy.sol.

Tools Used

Direct inspection of the Solidity code.

Recommendations

Change the ownership verification from tx.origin to msg.sender:

require(msg.sender == owner(), "not owner");
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

invalid_tx-origin

Lightchaser: Medium-5

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.