Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Functions send eth away from contract but performs no checks on any address

0xnightingale

Summary

Consider introducing checks for msg.sender to ensure the recipient of the money is as intended.

Vulnerability Details

  • Found in contracts/GmxProxy.sol ``Line: 539

function withdrawEth() external onlyOwner returns (uint256) {

  • Found in contracts/PerpetualVault.sol ``Line: 215

function deposit(uint256 amount) external nonReentrant payable

Impact

Add recipient address validation checks

  • Potential loss of funds if ETH is sent to incorrect/malicious addresses

  • Risk of permanent fund lock if sent to unusable addresses

  • No validation could lead to unauthorized withdrawals

Recommendations

Add recipient address validation checks

  • Implement address whitelisting for withdrawals

  • Add zero-address checks

  • Consider using a multi-signature mechanism for large withdrawals

  • Add event emissions for transfer tracking

Updates

Lead Judging Commences

n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.