Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

M-3 No Reentrancy Protection in IExchangeRouter.sol

radcipher

Summary

The IExchangeRouter interface includes functions that transfer tokens or Ether to a receiver, such as sendTokens(), sendWnt(), claimFundingFees(), and claimCollateral(). However, there are no checks to prevent transfers to the zero address (address(0)), which could lead to lost funds.
This function is also called in in GmxProxy.sol in GmxProxy.sol which is potentially causing reentrancy attack through gExchangeRouter.claimFundingFees(...)

// @audit - claimFungingFees no checks for address(0)
try
gExchangeRouter.claimFundingFees(markets, tokens, perpVault)

Vulnerability Details

sendWnt(address receiver, uint256 amount)

  • Transfers Wrapped Native Tokens (WNT) to receiver.

  • If receiver == address(0), WNT is burned forever.

sendTokens(address token, address receiver, uint256 amount)

  • Transfers arbitrary tokens to receiver.

  • If receiver == address(0), tokens are lost.
    claimFundingFees(address[] memory markets, address[] memory tokens, address receiver)
    *Sends funding fees to receiver, but does not check if receiver is zero.

claimCollateral(address[] memory markets, address[] memory tokens, uint256[] memory timeKeys, address receiver)

  • Claims collateral and sends it to receiver, but does not validate the receiver address.

Impact

  • Funds Loss: If tokens or Ether are sent to address(0), they become irrecoverable, leading to potential financial losses.

  • Misconfigurations: If a contract accidentally sets address(0) as a receiver, it could cause unintended fund burns.

  • Potential Exploits: Some protocols use address(0) for burn functions, and an attacker could manipulate this behavior to drain funds.

Tools Used

  • Manual review

Recommendations

  • Add Zero Address Validation in Implementations

  • Validate receiver in Claim Functions

  • Add Tests for Zero Address Edge Cases

Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.