Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Gas Price Manipulation in Execution Fee Calculation in createOrder() function

silverwolf

Summary

The contract calculates execution fees using tx.gasprice, which can be manipulated by miners/validators to inflate gas costs artificially, forcing excessive payment.

Vulnerability Details

• The execution fee is calculated as:

uint256 positionExecutionFee = getExecutionGasLimit(orderType, orderData.callbackGasLimit) * tx.gasprice;

• Risk: Miners or validators can artificially increase tx.gasprice, making transactions exorbitantly expensive.

Impact

• Unnecessary high transaction fees, leading to capital inefficiency.

• Can be exploited in front-running attacks, forcing users to overpay for orders.

Tools Used

• Manual Code Review

• Slither Static Analysis

Recommendations

• Use block.basefee instead of tx.gasprice to ensure fees are fair:

uint256 positionExecutionFee = getExecutionGasLimit(orderType, orderData.callbackGasLimit) * block.basefee;

• Implement gas limit sanity checks before processing transactions.

Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_tx-gasprice_instable

The frontrunner won’t trigger "congestion" without a huge amount of transactions, and it will cost a lot. Moreover, the execution gas limit is overestimated to prevent such cases: ``` executionGasLimit = baseGasLimit + ((estimatedGasLimit + _callbackGasLimit) * multiplierFactor) / PRECISION; ``` The keeper won’t wait long to execute the order; otherwise, GMX would not be competitive.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.