Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Users Will Overpay For Execution Fees If Order Is A Market Swap Order

sakshamseth5

Summary

Users orders requesting a market swap order from GMX will always overpay for the execution fee , this is because oraclePriceCount has been hardcoded to 5

Vulnerability Details

Consider the following ->

1.) Leverage of the perp vault is 1x and positionIsClosed is false (1x long position).

2.) A user comes to deposit , calls deposit() and since positionIsClosed is false _payExecutionFee() is triggered (L238) ->

if (positionIsClosed) {
MarketPrices memory prices;
_mint(counter, amount, false, prices);
_finalize(hex'');
} else {
_payExecutionFee(counter, true);

3.) Inside _payExecutionFee() ->

function _payExecutionFee(uint256 depositId, bool isDeposit) internal {
uint256 minExecutionFee = getExecutionGasLimit(isDeposit) * tx.gasprice;

4.) Inside getExecutionGasLimit() since _isLongOneLeverage is true (1x long position) ->

function getExecutionGasLimit(bool isDeposit) public view returns (uint256 minExecutionGasLimit) {
if (positionIsClosed == false) {
if (_isLongOneLeverage(beenLong)) {
minExecutionGasLimit = gmxProxy.getExecutionGasLimit(Order.OrderType.MarketSwap, callbackGasLimit);
}

5.) getExecutionGasLimit() is called from GmxProxy.sol , and there the uint256 oraclePriceCount = 5; is hardcoded , for our normal swap order (Market Swap Order) we wouldn't need 5 oracles and would need maximum of two oracles , therefore multiplying by 5 will produce a way higher base gas limit ->

uint256 oraclePriceCount = 5; // maximum number of oralce prices
baseGasLimit +=
dataStore.getUint(ESTIMATED_GAS_FEE_PER_ORACLE_PRICE) *
oraclePriceCount;

Impact

Users are overcharged for the execution fees specially for swaps , and since excess fees sent to GMX is not refunded to users in gamma this is a loss of funds for the users.

Tools Used

Manual analysis

Recommendations

Dont' hardcode oraclePriceCount to 5.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!