Liquidity Management

Summary

In our current implementation, the minOutputAmount parameter for GMX swap orders is hardcoded to 0. This means that there is no safeguard ensuring that a minimum amount of output tokens is received when executing a trade. Normally, this value should be calculated dynamically based on the expected output and a tolerable slippage margin. Without this protection, adverse market movements between the order's submission and execution can result in significantly worse execution rates than anticipated, potentially causing substantial losses.

Vulnerability Details

1. GMX Swaps have disabled price protection:

In GmxProxy:

Impact

With acceptablePrice set to 0, the protocol does not enforce a minimum price threshold. This leads to:

• Adverse Price Movements: A sudden unfavorable market movement could result in execution at a price far below what was anticipated.

• Front-Running Risks: Malicious actors could exploit the absence of a price floor to trigger executions at severely disadvantageous rates.

Tools Used

Manual review

Recommendations

Instead of hardcoding acceptablePrice to 0, calculate it dynamically using real-time market data and a configurable slippage tolerance. This ensures that the order only executes if the received price is above a predetermined minimum threshold.