Liquidity Management

Summary

The getExecutionGasLimit() function in the GmxProxy contract accepts a _callbackGasLimit parameter from external inputs without imposing any upper limit. A malicious or compromised keeper can pass an excessively large value, resulting in inflated execution fees paid by users. This can lead to unnecessary fund depletion or potentially prevent operations due to prohibitively high fees, causing a Denial of Service (DoS) for users attempting to interact with the protocol.

Vulnerability Details

In GmxProxy.sol -> function getExecutionGasLimit

function getExecutionGasLimit(
Order.OrderType orderType,
uint256 _callbackGasLimit
) public view returns (uint256 executionGasLimit) {
...
executionGasLimit =
baseGasLimit +
((estimatedGasLimit + _callbackGasLimit) * multiplierFactor) / PRECISION;
}

The callbackGasLimit parameter is provided externally, and the **callbackGasLimit**can also be updated by the owner without an upper limit . There is no upper bound validation on this parameter in both cases. This unchecked value is added to the estimated gas limit and used to calculate the execution fee. A malicious actor (either the owner or a keeper) can set or submit (either intentionally or accidentaly) an excessively high _callbackGasLimit, resulting in:

• Excessive gas fees paid by users for deposit, withdrawal, or position adjustments.

• Potential DoS, as users may be unable to afford the excessively high execution fees.

Severity

Severity Assessment:

• Impact: Medium – Direct financial loss to users, and potential inability to manage leveraged positions.

• **Likelihood: Low **– Requires malicious/accidental action from a trusted keeper or owner.

Recommendations

In the

Implement an upper bound validation check for _callbackGasLimit to prevent excessive values:

Example:

1.Add the consttant MAX_CALLBACKGAS_LIMIT to the GMXPROXY.sol

2.Add the rquired check to the getExecutionGasLimit line 162.

Also, in PerpetualVault.sol, when setting callbackGasLimit via setCallbackGasLimit() function, add an upper limit check to avoid excessive values:

This approach will help prevent unintended or malicious configurations that could harm protocol users.