Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unchecked External Call in createOrder Leads to DoS & Fund Loss on GmxProxy

0x0107

Summary

The createOrder function in GmxProxy makes an unchecked external call to gExchangeRouter.createOrder(params).
If a malicious or broken market contract is provided, it can revert, causing ETH to be locked permanently in GmxProxy.

This results in:

  • Permanent Denial of Service (DoS) for order execution.

  • Locked ETH that cannot be recovered, leading to fund loss.

Vulnerability Details

bytes32 requestKey = gExchangeRouter.createOrder(params);
queue.requestKey = requestKey;
​

  • The function assumes createOrder always succeeds.

  • No checks for failed transactions.

  • If the market contract maliciously reverts, the ETH sent to sendWnt remains stuck in orderVault.

PoC

  1. Attacker registers a fake market that always reverts orders.

  2. Calls createOrder, causing ETH to be sent but order never executes.

  3. ETH remains locked in orderVault, making it unrecoverable.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.4;
​
import {Test} from "forge-std/Test.sol";
import {GmxProxy} from "../src/GmxProxy.sol";
import {MaliciousMarket} from "../src/MaliciousMarket.sol";
​
contract GmxProxyExploitTest is Test {
GmxProxy gmxProxy;
MaliciousMarket fakeMarket;
address attacker = address(0x2);
​
function setUp() public {
gmxProxy = new GmxProxy();
fakeMarket = new MaliciousMarket();
// Fund GmxProxy contract with 5 ETH
vm.deal(address(gmxProxy), 5 ether);
}
​
function testDoSWithMaliciousMarket() public {
vm.startPrank(attacker);
​
// Attacker tries to execute an order with a fake market
vm.expectRevert("Malicious Market Reverted!");
gmxProxy.createOrder(GmxProxy.OrderType.MarketIncrease, fakeMarket);
​
// Check ETH is locked
assertEq(address(gmxProxy).balance, 5 ether, "ETH should be stuck!");
​
vm.stopPrank();
}
}
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.4;
​
contract MaliciousMarket {
function createOrder() external pure {
revert("Malicious Market Reverted!");
}
}

Impact

  1. Denial of Service (DoS) - Orders cannot be executed because queue.requestKey never updates.

  2. Permanent ETH Lock - ETH sent in sendWnt(orderVault, positionExecutionFee) remains stuck.

  3. Protocol Funds Loss - Repeated attacks can drain user funds, making the vault unusable.

Tools Used

Manual Review, Foundry

Recommendations

Wrap the external call in a try-catch block to revert gracefully instead of locking funds.

try gExchangeRouter.createOrder(params) returns (bytes32 requestKey) {
queue.requestKey = requestKey;
} catch {
revert("Order execution failed! Reverting transaction.");
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.