DeFiFoundry
50,000 USDC
View results
Submission Details
Severity: medium
Invalid

Deadlock Risk Due to Missing _gmxLock Reset

Summary

In the _createIncreasePoaition() function the _gmxLock flag is set to true when creating an order via GMX but is never reset to false after execution.
This creates a deadlock where future GMX operations (such as opening, closing, or modifying positions) can never be executed, effectively breaking all trading functionality.

Vulnerability details

Issue in _createIncreasePosition()

_gmxLock = true; // Lock set to prevent reentrancy
gmxProxy.createOrder(orderType, orderData); // No guarantee this succeeds
// Missing _gmxLock = false; in case of failure
}

But it is important for both success and failure scenarios of createOrder
Additionally, it must be reset (_gmxLock = false) once the order is completed, or new orders will be blocked indefinitely.

Same issue in _createDecreasePosition, settle() and some other functions

Impact

  • No further GMX orders can be placed after the first one if _gmxLock remains true.

  • Users could get stuck in positions, unable to withdraw or adjust their trades.

  • Protocol operations relying on GMX orders (e.g., liquidations, rebalances) may fail indefinitely.

Tools Used

Manual Review

Recommendations

Reset _gmxLock in a callback after execution:
Example implementation

function _onOrderExcecution(bool success) internal {
_gmxLock = false; // Unlock after execution
if (!success) {
revert("GMX order execution failed");
}
}
  • Ensure _gmxLock resets if createOrder() fails immediately:
    Example Implementation

function _createIncreasePosition(...) internal {
_gmxLock = true;
try gmxProxy.createOrder(orderType, orderData) {
// Order created successfully
} catch {
_gmxLock = false; // Unlock if order creation fails
revert ("GMX order creation failed");
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

olami9783 Submitter
11 months ago
olami9783 Submitter
11 months ago
n0kto Lead Judge
10 months ago
n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!