Liquidity Management

Summary

The settle(...) function of GmxProxy.solhardcodes the minOutputAmount: 0 to zero when creating the param struct to call the gExchangeRouter.createOder(params)function of GMX.

The comment in front of the hardcoded minOutputAmount: 0assumes that the minOutputAmountis not used on the GMX Market decrease logic. Contrary to this assumption, the minOutputAmountis used for validation after the swap in the GMX code with the [_validateOutputAmount(...)]() function.

This can lead to loss of asset through slippage loss.

Even quoting from the GMX docs, NOTE: For decrease orders this is the minimum USD value, USD is used in this case because it is possible for decrease orders to have two output tokens

here is the full quote from:

>minOutputAmount: For swap orders this is the minimum token output amount. For increase orders this is the minimum token amount after the initialCollateralDeltaAmount is swapped through the swapPath. NOTE: For decrease orders this is the minimum USD value, USD is used in this case because it is possible for decrease orders to have two output tokens, one being the profit token and the other being the withdrawn collateral token

Vulnerability Details

Zero is hardcoded as the minOutputAmountin the settle(...)function.

The comment assumes that the minOutputAmountis not used in the GMX logic for Market Decrease. However the minOutputAmountis used to validate the output amount to prevent slippage loss in the [_validateOutputAmount(...)]() function.

Let's look at the GMX Market decrease implementation

And the below is the implementation of _validateOutputAmount(...)

Impact

Loss of asset due to slippage loss from sandwich attack.

Tools Used

[_validateOutputAmount(...)]() function of GMX decrease order logic

Recommendations

Consider passing implementing the minOutputAmount input on the settle(...) function like it is done for the createOder(...)function instead of hardcoding it to zero. Note that this minOutputAmountis in USD.