Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Input Validation for setPerVault() function in GmxProxy

silverwolf

Summary

setPerpVault() function do not validate addresses before setting them, leading to potential misconfigurations or contract hijacking.

Vulnerability Details

• setPerpVault() incorrectly checks ownership:

require(tx.origin == owner(), "not owner");

• tx.origin is not reliable as it can be spoofed via external calls.

• There is no validation for market address.

Impact

• Contract takeover risk if an attacker injects a malicious vault address.

• Possible permanent loss of funds if an incorrect address is set.

Tools Used

• Manual Code Review

• Slither Static Analysis

Recommendations

• Replace tx.origin with msg.sender:

require(msg.sender == owner(), "not owner");

• Validate input addresses before setting them:

require(market != address(0), "invalid market address");
Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

invalid_tx-origin

Lightchaser: Medium-5

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.