Liquidity Management

Summary

tx.origin is being used in contract GmxProxy.sol but it is advisable not to use tx.origin for main access control functions.

Vulnerability Details

Code:

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/GmxProxy.sol#L352C13-L352C22

Impact

1. Also it can lead to a bug if someone detects GMXproxy is deployed but vault is not set and runs it before Perpetual vault deployment

2. Many DeFi owners operate through Multisigs or Account Abstraction wallets, where tx.origin does not reliably represent the actual end user.

Tools Used

Manual Review

Recommendations

Better to use msg.sender or use owner variable for passing from Perpetual vault contract to GMXproxy contract and replace tx.origin with msg.sender/owner in this contract