Submission Details
Severity:
Unsafe use of tx.origin
Description:
GmxProxy.setPerpVault uses tx.origin == owner() for authorization. This allows phishing attacks where a malicious contract impersonates the owner.
Impact:
Unauthorized vault setup if owner interacts with a malicious contract.
Affected Code:
GmxProxy.sol#setPerpVault()checkstx.origin == owner.
Recommendation:
Replace tx.origin with msg.sender for authorization.
Updates
Lead Judging Commences
n0kto 7 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid_tx-origin
Lightchaser: Medium-5
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026 USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.