Liquidity Management

Summary

When a user deposits collateral tokens, they must pay an executionFee to create a GMX order based on their current position. The _payExecutionFee function ensures that msg.value is greater than minExecutionFee but does not enforce a maximum cap. This oversight can result in users' funds becoming stuck in the protocol

Similarly when user withdrawas collateral token and currentPositionKey is empty then user should not pay executionFee.

Vulnerability Details

1. current state, positionIsClosed == false.

2. user deposits collateral token with msg.value as minExecutionFee + 1e10

3. The keeper creates an Order for the user and mints the necessary shares

4. as an GMX order was placed so their would be no refund leading to user not getting their fee back.

Impact

Users won't be able to get their excess fee back from the protocol and might have to pay executionFee even when position is closed.

Recommendations

Implement a Maximum cap on the msg.value in _payExecutionFee function so that the fee payed by the user won't exceed a certain limit.