Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Permanently Paused Deposits

kwakudr

Summary

Vulnerability Details

function afterLiquidationExecution() external {
if (msg.sender != address(gmxProxy)) {
revert Error.InvalidCall();
}

depositPaused = true;
uint256 sizeInTokens = vaultReader.getPositionSizeInTokens(curPositionKey);
if (sizeInTokens == 0) {
delete curPositionKey;
}
​
​
if (flow == FLOW.NONE) {
flow = FLOW.LIQUIDATION;
nextAction.selector = NextActionSelector.FINALIZE;
} else if (flow == FLOW.DEPOSIT) {
flowData = sizeInTokens;
} else if (flow == FLOW.WITHDRAW) {
// restart the withdraw flow even though current step is FINALIZE.
nextAction.selector = NextActionSelector.WITHDRAW_ACTION;
}

}

When a liquidation occurs, the afterLiquidationExecution function is called.This sets depositPaused = true, blocking new deposits.

The deposit function checks depositPaused.

After liquidation, this check will always fail, preventing new deposits.

The contract never resets depositPaused to false in:

Liquidation handling (afterLiquidationExecution/runNextAction)

Position closure (_finalize)

Withdrawal flows

The only way to unpause is via an explicit owner call.

function setDepositPaused(bool _depositPaused) external onlyOwner {
depositPaused = _depositPaused;
}

If the owner forgets to call this, deposits remain paused forever.

Example:

afterLiquidationExecution sets depositPaused = true.

Keeper calls runNextAction to finalize, but depositPaused stays true.

Transaction reverts due to depositPaused == true

Requires manual setDepositPaused(false) to fix

Impact

Deposits stay paused indefinitely after liquidation until owner steps in.

Tools Used

Foundry

Recommendations

Add logic to automatically unpause deposits after liquidation handling.

Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.