Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Risk of Reverts in GMX Callback due to Strict Validations

johnlaw

Data Validation, Denial of Service, Logic Issue

Summary

The afterOrderExecution callback reverts on unauthorized callers and performs division operations on zero values, contradicting the requirement that it must never revert.

Vulnerability Details

afterOrderExecution checks msg.sender != address(gmxProxy) and reverts if the caller is not the gmxProxy. It also divides by prices.shortTokenPrice.min, which triggers a division-by-zero revert if the incoming data is zero. These behaviors break the contract’s stated requirement of never reverting in its post-execution logic, causing unnecessary denial of service risks.

if (msg.sender != address(gmxProxy)) {
revert Error.InvalidCall();
}
​
uint256 feeAmount = vaultReader.getPositionFeeUsd(market, orderResultData.sizeDeltaUsd, false) / prices.shortTokenPrice.min; // Division by zero risk if prices.shortTokenPrice.min is zero

Impact

Impact: Medium. The callback reverts and halts operations whenever unexpected callers invoke it or when external price feeds report zero. The protocol experiences downtime that disrupts order flows.
Likelihood: Low. Only the authorized GMX proxy normally invokes afterOrderExecution, and real-time Chainlink or GMX price feeds rarely return zero.

Tools Used

  1. A third-party system mistakenly invokes afterOrderExecution instead of the authorized gmxProxy.

  2. The function reverts with Error.InvalidCall().

  3. The contract never completes its post-order logic.

  4. Alternatively, a zero price input triggers a division-by-zero revert, blocking successful execution.

Recommendations

Replace reverts on invalid callers with a no-op or a logged warning if the contract must never revert:

1. if (msg.sender != address(gmxProxy)) {
2. // Optionally log an event or simply return
3. return;
4. }

Validate that prices.shortTokenPrice.min != 0 before performing divisions to prevent unexpected halts:

if (prices.shortTokenPrice.min == 0) {
// Gracefully handle zero price scenario
return;
}

Ensure fallback logic handles abnormal external data without reverting.

Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.