Liquidity Management

Code Areas

Summary

When a single user requests a withdrawal, the vault may be forced to close the entire GMX position if maintaining a partial position becomes impossible. In such cases, all withdrawn collateral is incorrectly sent to the withdrawing user, resulting in a complete loss of funds for other depositors in the vault.

Vulnerability Details

The vulnerability occurs in the withdrawal process when willPositionCollateralBeInsufficient is triggered. This can happen due to:

• GMX's decreasing max leverage over time

• Accumulated funding fees

• Price impact from position changes

When triggered, the vault closes the entire position by setting sizeDeltaInUsd to the full position size:

However, the withdrawal logic incorrectly assumes that only the withdrawing user's portion should be processed, leading to a critical accounting error where all withdrawn funds are sent to a single user.

Issue Two

Another related issue is that under such market conditions, any user can force the rest of the traders out of the market, giving them zero market exposure.

Proof of Concept

Consider this scenario with 3 users who each deposited 100 tokens:

1. Total position size = 300 tokens

2. User A requests withdrawal of their 100 tokens (1/3 of position)

3. Due to GMX constraints, the entire position must be closed

4. All 300 tokens are withdrawn to the vault

5. The withdrawal process executes:

1. Result:

   • User A receives 300 tokens

   • Users B and C lose their 200 tokens despite still having valid shares

Impact Details

The vulnerability allows the first withdrawing user to receive the entire position's collateral, causing a complete loss of funds for all other depositors in the vault. This breaks the fundamental principle of proportional share distribution and represents a critical security issue since any user could potentially drain the entire vault during their withdrawal, regardless of their actual share percentage.

Tools Used

Manual Review

Recommendations

For simplicity and a solution that fixes both issues:

• Add a mechanism that prevents the withdrawal of tokens if it's going to lead to the closure of the position. This prevents a griefer from forcing the rest of the traders out of the market.

• Add a rebalancing mechanism that adjusts the risk exposure of the vault's position, such that any user can redeem their shares when needed. This avoids forcing users to stay in the market against their will, and protects the non-withdrawers from losing their tokens during other user's withdraw events.