Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Unused fee can never be refunded back to user in `_handleReturn`

y4y

Summary

For deposits, there can be execution fees to send to GMX proxies, after the order execution has finished, not all of provided gas amount will be used up, and those excess ones are sent back to user. In _handleReturn, the logic is in incorrect order, which will make intended refund not possible.

Vulnerability Details

Here at the end of _handleReturn:

_burn(depositId);
​
if (refundFee) {
uint256 usedFee = callbackGasLimit * tx.gasprice;
if (depositInfo[depositId].executionFee > usedFee) {
try
IGmxProxy(gmxProxy).refundExecutionFee(
depositInfo[counter].owner,
depositInfo[counter].executionFee - usedFee
)
{} catch {}
}
}
​
// update global state
delete swapProgressData;
delete flowData;
delete flow;

If there is refund option set, and the function will try to refund excess execution fees back to user, but we notice, before the if branch, _burn is called, and in such function:

function _burn(uint256 depositId) internal {
EnumerableSet.remove(
userDeposits[depositInfo[depositId].owner],
depositId
);
totalShares = totalShares - depositInfo[depositId].shares;
delete depositInfo[depositId];
}

It deletes depositInfo[depositId] by setting all fields to empty value. Back in _handleReturn, execution fees to be refunded is calculated using depositInfo[depositId].executionFee > usedFee, but since depositInfo[depositId] has already been deleted, so this branch will never be reached, and the refund will never happen.

Impact

Some deposits' execution fee will never be refunded

Tools Used

Manual review

Recommendations

_burn after the refund logic.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_burn_depositId_before_refund

Likelihood: High, every time a user withdraw on 1x vault with paraswap Impact: Medium, fees never claimed to GMX and refund to the owner.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!