Liquidity Management

Summary

Inside GmxProxy.sol, there is a function createOrder at line 406. The safeApprove function should first be called to approve 0 tokens before approving a new value. This is to prevent issues when changing approvals from one non-zero value to another.

Vulnerability Details

The safeApprove function does not allow changing an approval directly from one non-zero value to another. If this is attempted, it could result in unexpected behavior or failures in token transfers.

Impact

• Potential Token Loss: If the approval does not reset correctly, it may lead to incorrect token transfers.

• Unexpected Failures: Some tokens enforce strict rules on approvals, which can cause transactions to fail if not handled properly.

Tools Used

• Manual Code Review

• Solidity Static Analysis Tools

Recommendations

Solution: Reset Approval Before Setting New Value

Refactor safeApprove to first approve 0 before setting a new approval.

Updated Code

This ensures that the approval process works correctly, preventing unexpected failures or incorrect token transfers.