Liquidity Management

Summary

The setPerpVault function in GMXProxy.sol uses tx.origin to verify the caller's identity. This introduces a security risk where an attacker can trick the contract owner into executing a malicious transaction, potentially allowing unauthorized vault configuration.

Vulnerability Details

The function checks if tx.origin == owner().

• tx.origin refers to the original externally owned account (EOA) that initiated the transaction, even if the call is made through an intermediate contract.

• This allows an attacker to deploy a malicious contract and trick the owner into calling it. The malicious contract can then call setPerpVault, with tx.origin still being the owner, bypassing access controls.

Link to the code

Impact

• Unauthorized modification of the perpetual vault address which potentially allows unauthorized access.

• Potential loss of funds if the vault manages user deposits.

Tools Used

Manual Code Review

Recommendations

Replace tx.origin with msg.sender for access control: