Liquidity Management

Summary

The PerpetualVault::afterLiquidationExecution function is triggered by the gmxProxy contract when a liquidation callback is received from GMX. However, the function fails to set isPositionClosed to true when a position is liquidated during the deposit or withdraw flow, potentially causing unintended protocol behavior.

Vulnerability Details

1. current state, beenLong == true, leverage == 10_000, positionIsClose == false

2. User calls the withdraw function, nextAction.selector is set to NextActionSelector.WITHDRAW_ACTION.

3. The position get liquidated and afterLiquidationExecution gets called.

4. as the current flow is withdraw so the nextAction stays the same.

5. keeper calls the runNext function which calls the _withdraw function

6. The _withdraw function checks if the positionIsClosed is true or false.

7. As the positionIsClosed is currently false and _isLongOneLeverage(beenLong) is true, causing the protocol to place a MarketSwap order with swapAmount as 0 leading to an error from the GMX as the position has been liquidated.

Impact

When withdrawing collateral tokens, the protocol bypasses the (positionIsClosed == true) check, which can result in incorrect fund transfers or prevent users from retrieving their funds.

Tools Used

Manual Review

Recommendations

Add a mechanism in the afterLiquidationExecution function to allocate isPositionClose to be true when the flow is withdraw and deposit.