Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Gas Estimation Error with Unhandled Order Types in getExecutionGasLimit Function

efccweb3

Summary

A gas calculation vulnerability was identified in the getExecutionGasLimit function. The function does not handle new or unhandled OrderTypes, leading to an underestimation of the gas limit, which could cause transaction reverts.

Vulnerability Details

The function calculates executionGasLimit based on the OrderType. However, if a new OrderType is added to the enum but not explicitly handled in this function, estimatedGasLimit defaults to 0.

This results in:

executionGasLimit = baseGasLimit + ((0 + _callbackGasLimit) * multiplierFactor) / PRECISION;

Leading to an underestimation of the required gas for unhandled order types.

Impact

Transactions involving new or unhandled OrderTypes might fail due to insufficient gas, potentially disrupting the functionality of the contract with new features or updates.

Tools Used

Recommendations

Add a default case for unhandled OrderTypes:

else {
estimatedGasLimit = dataStore.getUint(DEFAULT_ORDER_GAS_LIMIT) + gasPerSwap;
}

OR

Before gas calculation, check if the orderType is one of the known types:

require(
orderType == Order.OrderType.MarketIncrease ||
orderType == Order.OrderType.MarketDecrease ||
...
"Unsupported order type"
);
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.