Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Gas Estimation if for Multi-Hop Swaps will cause revert

efccweb3

Summary

The createOrder function does not pass the swapPath parameter (from orderData) to getExecutionGasLimit, leading to incorrect gas estimations for orders involving multi-hop swaps. This results in transactions reverting due to insufficient gas, risking failed order executions.

Vulnerability Details

The getExecutionGasLimit function relies on swapPath.length to calculate the number of swaps (numSwaps = swapPath.length - 1). However, createOrder does not provide swapPath to getExecutionGasLimit, causing the latter to default to 1 swap (or zero if uninitialized).

POC

Scenario: Multi-Hop Swap with 2 Swaps
Order Data:

swapPath = [ETH, BTC, USDC](2 swaps).

SINGLE_SWAP_GAS_LIMIT = 50,000 gas.

tx.gasprice = 20 gwei.

Current Behavior:

getExecutionGasLimit assumes numSwaps = 0 (no swapPath passed).

Gas allocated: 0 * 50,000 = 0 gas for swaps.

positionExecutionFee = (baseGas + 0) * 20 gwei = undervalued fee.

Execution:

The contract checks address(this).balance >= undervalued fee (passes).

During execution, the transaction requires 2 * 50,000 = 100,000gas but only0` gas is allocated → Revert.

Impact

Orders requiring multi-hop swaps will revert due to gas exhaustion.

Tools Used

Manual review

Recommendations

Pass swapPath to getExecutionGasLimit in createOrder:

function createOrder(...) public returns (bytes32) {
// ...
uint256 positionExecutionFee = getExecutionGasLimit(
orderType,
orderData.callbackGasLimit,
orderData.swapPath // Pass swapPath here
) * tx.gasprice;
//
}

Update getExecutionGasLimit to Use swapPath:

function getExecutionGasLimit(
Order.OrderType orderType,
uint256 _callbackGasLimit,
address[] calldata swapPath // Add parameter
) public view returns (uint256) {
// ...
uint256 numSwaps = swapPath.length > 0 ? swapPath.length - 1 : 0;
gasPerSwap = dataStore.getUint(SINGLE_SWAP_GAS_LIMIT) * numSwaps;
// ...
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_swapPath_does_not_increase_the_executionFee

Likelihood: Low/Medium, when swapPath has more than 1 item. Impact: Medium/High, could lead to not enough fee collected to execute the transaction in GMX

Appeal created

sakshamseth5 Auditor
10 months ago
0xl33 Auditor
10 months ago
n0kto Lead Judge
10 months ago
n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_swapPath_does_not_increase_the_executionFee

Likelihood: Low/Medium, when swapPath has more than 1 item. Impact: Medium/High, could lead to not enough fee collected to execute the transaction in GMX

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!