Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Wrong event emission values when strategy changes position to long 1x leverage

fresh

Summary

When a strategy changes a position to opening a long 1x leverage- there is a substantial code path that is executed across many different functions -> the end result of the execution emits the wrong values in the event gmxPositionUpdated-> which doesnt accurately represent the change of the position.

Vulnerability Details

The event gmxPositionUpdated takes the following paramaters:

event GmxPositionUpdated(
bytes32 positionKey,
address market,
bool isOpen,
bool isLong,
uint256 sizeInTokens,
uint256 indexTokenPrice
);

The problem is that isOpenand sizeInTokenswill be populated incorrectly.

For this change in position - opening a long 1x leverage position:

isOpenis true becasue the position will be opened and throughout the execution isOpen is true

sizeInTokensshould represent the amount of tokens that were swapped becasue 1x leverageonly does a swap.

For the sake of simplicity, I will not walk through the entire codepath becasue it will be very long report for a low. But these are the values that are set during the codepath:

OrderType.Type = MARKET_SWAP-> set at the very beginning in runfunction.

flow = FLOW``.SIGNAL_CHANGE

When swapping with gmx- _doGmxSwap is called which opens and completes a swap in the gmxProxy - this is the value for sizeDeltaUsdset: This value of 0 is used for the remainder of the code path.

IGmxProxy.OrderData memory orderData = IGmxProxy.OrderData({
market: address(0),
indexToken: address(0),
initialCollateralToken: tokenIn,
swapPath: gPath,
isLong: isCollateralToIndex, // this param has no meaning in swap order, but uses it to see the swap direction
-> sizeDeltaUsd: 0,

When the code path meets its end, in afterOrderExecutionthis final patch of code is executed, emitting the event and populating the event incorrectly: look at comments in the code

if (flow == FLOW.SIGNAL_CHANGE) {
emit GmxPositionUpdated(
positionKey,
market,
// This represents 'isOpen' - which should be true if position is open, which it is now
-> // THis will be `false` because the order type is `MARKET_SWAP` not `MarketIncrease`
orderResultData.orderType == Order.OrderType.MarketIncrease,
orderResultData.isLong,
// THis will be 0, but is supposed to represent `sizeInTokens`
// Which should be the output amount of the swap
-> orderResultData.sizeDeltaUsd,
prices.indexTokenPrice.min
);

Impact

The event will emit:

falsefor isOpenparameter -> which is incorrect and notifies that the position is closed when in fact it is open

0for sizeInToken-> which should be the output amount of tokens from the swap

Tools Used

manual review

Recommendations

Update the input paramaters for the event GmxPositionUpdated:

isOpenshould be true

sizeInTokensshould be the output amount of tokens of the swap

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.