Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Order Existence Check in GmxProxy::cancelOrder

ghufranhassan1

Summary

The function checks if queue.requestKey is not zero before attempting to cancel the order. However, it does not verify if the order associated with queue.requestKey is valid or still pending in gExchangeRouter.

function cancelOrder() external {
require(msg.sender == perpVault, "invalid caller");
require(queue.requestKey != bytes32(0), "zero value");
gExchangeRouter.cancelOrder(queue.requestKey);
}

Vulnerability Details


The potential issue with the cancelOrder function, where it does not verify if the order associated with queue.requestKey is valid or still pending in gExchangeRouter,

Impact

  • If the order is not pending and the cancellation attempt fails, the queue.requestKey might not be reset, leading to repeated and futile cancellation attempts.

  • Continuously attempting to cancel an order that is no longer valid can lead to wasted gas and operational inefficiencies

Tools Used

Manual Review

Recommendations

  • Implement checks to verify the order's status before attempting cancellation.

  • Ensure that the contract's state is updated appropriately after a cancellation attempt, successful or not.

function cancelOrder() external {
require(msg.sender == perpVault, "invalid caller");
require(queue.requestKey != bytes32(0), "zero value");
// Check if the order is still pending
require(gExchangeRouter.isOrderPending(queue.requestKey), "order not pending");
gExchangeRouter.cancelOrder(queue.requestKey);
// Optionally reset the requestKey after cancellation
queue.requestKey = bytes32(0);
}
​
​
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.