Submission Details
Severity:
Dangerous usage of tx.origin in setPerpVault(), GmxProxy.sol
Summary
The setPerpVault function uses tx.origin for authorization.
Vulnerability Details
tx.origin-based protection can be abused by a malicious contract, tx.origin refers to the original external account that initiated the transaction, not the immediate caller (msg.sender. A malicious smart contract can trick a legitimate user into interacting with setPerpVault(), bypassing the security checks, and could gain control over perpVault.
function setPerpVault(address _perpVault, address market) external {
require(tx.origin == owner(), "not owner");
require(_perpVault != address(0), "zero address");
require(perpVault == address(0), "already set");
perpVault = _perpVault;
gExchangeRouter.setSavedCallbackContract(market, address(this));
}
Impact
Unauthorized Contract Ownership Change
Contract manipulation
Loss of funds
Tools Used
Manual review
Recommendations
Do not use tx.origin for authorization.
Replace:
require(tx.origin == owner(), "not owner");
With:
require(msg.sender == owner(), "not owner");`
Updates
Lead Judging Commences
n0kto 6 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid_tx-origin
Lightchaser: Medium-5
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026 USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.