Summary

A vulnerability has been identified in the GMXProxy contract where the setPerpVault function uses tx.origin for access control instead of msg.sender. This could allow an attacker to gain unauthorized admin privileges through a sophisticated phishing attack, potentially compromising the entire protocol's security.

Vulnerability Details

The vulnerability exists in the setPerpVault function of the GMXProxy contract:

The function uses tx.origin for owner authentication instead of the more secure msg.sender. This creates a potential attack vector where a malicious contract could bypass the ownership check through transaction origin spoofing.

An attacker could exploit this vulnerability through the following attack flow:

1. Deploy a malicious contract with an attractive airdrop function ,note that beforehand we need to be a usual user by deposit funds (small but okay so that we can call withdraw from perpVault)

   contract MaliciousAirdrop {

   address public gmxProxy;

   ​

   constructor(address _gmxProxy) {

   gmxProxy = _gmxProxy;

   }

   ​

   function claimAirdrop() external payable {

   // Trigger refundExecutionFee flow

   IPerpetualVault(perpVault).withdraw();

   }

   ​

   receive() external payable {

   // Called when receiving refund

   }

   }

2. Create a phishing campaign targeting the owner

3. When the owner interacts with the malicious contract:

   • The transaction origin will be the owner's address

   • The malicious contract can call setPerpVault through its receive function

   • The tx.origin check will pass, allowing the attack to succeed

Impact

The vulnerability could allow an attacker to:

1. Take control of the GMXProxy contract by changing the perpVault address

2. Manipulate protocol operations through unauthorized admin access

3. Potentially drain funds or disrupt protocol functionality

The impact is considered medium instead of high because:

• It compromises a critical access control mechanism

• Could lead to complete protocol compromise

• Requires only a successful phishing attempt on the owner

Tools Used

• Manual code review

Recommendations

Replace tx.origin with msg.sender