Liquidity Management

Description

First, let's take a look at the action performed by Gamma when GMX's ADL (Automatic Deleveraging) invokes GmxProxy.sol's afterOrderExecution() callback:

Any collateral & index tokens received from GMX are transferred to the PerpetualVault. And if this ADL has not resulted in the entire position size to be de-leveraged i.e. sizeInUsd > 0, then afterLiquidationExecution() is NOT called.

With that in mind, let's now look at a user's withdrawal flow:

1. User calls withdraw(). This sets flow = FLOW.WITHDRAW.

2. If there's an open position, calls _settle() which creates a GMX order.

3. GMX executes the settle order, triggering afterOrderExecution(). This sets nextAction = NextActionSelector.WITHDRAW_ACTION.

4. Keeper calls runNextAction() which if needed, swaps any indexTokens to collateralTokens.

5. Calls _withdraw() which creates a GMX decrease position order.

6. GMX executes decrease order, triggering afterOrderExecution(). This sets nextAction = NextActionSelector.FINALIZE.

7. Keeper calls runNextAction() which calls _finalize() which calls _handleReturn() to process the withdrawal.

However, _finalize() and _handleReturn() rely on contract's collateral token balance to determine how much withdrawn amount is to be credited back to the user. If an ADL inadvertently happens between steps 6 and 7, i.e. Keeper's runNextAction() gets front-runned coincidentally in the same block (Or Keeper fails to notice the ADL event and calls runNextAction() anyway), then user receives more than they should:

Impact

• User will receive both their proportional share from the decrease order AND the ADL tokens

• This is incorrect since ADL tokens should be distributed across all position holders. Essentially, other position holders take a loss.

Recommendation

The fix may not be quite that simple. We may need to properly track credited tokens during ADL, perhaps by having ADL tokens flow into a separate accounting bucket.

Another way could be to increment prevCollateralBalance inside the if (msg.sender == address(adlHandler)) branch when afterOrderExecution() callback happens.