Submission Details
Severity:
user can not refund withdraw fee
Summary
function _cancelFlow() internal {
} else if (flow == FLOW.WITHDRAW) {
try IGmxProxy(gmxProxy).refundExecutionFee(
depositInfo[counter].owner,
depositInfo[counter].executionFee
) {} catch {}
}
// Setting flow to liquidation has no meaning.
// The aim is to run FINAIZE action. (swap indexToken to collateralToken);
flow = FLOW.LIQUIDATION;
nextAction.selector = NextActionSelector.FINALIZE;
}
When canceling the flow in the FLOW.WITHDRAW state, it does not cancel the withdrawal request, but instead, it cancels the order of the depositId of the counter variable. As a result, the user loses the fee, and the last user who deposited will receive the fee.
If there are no depositing users, the last depositor (the attacker) could withdraw the fee multiple times.
References
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026 USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.