Liquidity Management

Summary

The protocol fails to prorate losses (insolvency) or negative fees (liquidations), allowing early exits to drain collateral unfairly.

When the vault’s net equity turns negative—whether during routine withdrawals or mass liquidations—the current calculations do not account for the proportional allocation of losses. As a result, early withdrawers may receive a disproportionate amount of collateral while later users are forced to absorb the entire loss.

Vulnerability Details

The withdrawal function via _handleReturn

computes the user’s redeemable amount as:

This calculation assumes that the vault’s collateral value is positive. In an insolvency event (for example, where total liabilities exceed assets), the simple proportional division ignores the negative net value.

Scenario:

• Total shares: 1,000

• Collateral balance: 500 USDC

• Implied liabilities: 1,000 USDC (net equity = –500 USDC)

• A user with 500 shares would, by the current formula, withdraw: 500 × (500⁄1000) = 250 USDC
  --> This leaves the vault with a negative burden that then must be borne entirely by remaining depositors, effectively freezing or greatly reducing withdrawals for later users.

Example:-

• A vault is operating under stress where market losses have driven net equity negative, example collateral worth USD 1,000 with liabilities of USD 1,500

• Two depositors hold equal shares.

• The first depositor withdraws using the current formula and receives an amount based solely on the nominal collateral balance.

• The second depositor’s share is then calculated on an even lower remaining collateral balance, effectively absorbing the full loss.

• The differences between the early and late withdrawals demonstrates that the protocol’s withdrawal mechanism does not share losses proportionally.

Similarly, during mass liquidations the fee–claiming mechanism (such as in GmxProxy.afterOrderExecution globally applies negative funding fees without tracking individual exposure. Thus, if some users exit early, the entire fee burden falls on those left in the system.

Impact

Early withdrawers might extract a full‐value payout while later withdrawers see their shares dramatically devalued. Depositors who remain in the vault absorb 100% of losses, potentially locking funds or forcing further liquidations. This violates the fair share invariant and may lead to systemic user distrust.

Tools Used

Manual Review

Recommendations

Track each depositor’s share‐age (or use a time‑weighted share mechanism) so that both deposits and withdrawals account for accrued losses. For example, calculate a user’s effective claim as the difference between their proportional entitlement of assets and of liabilities, such as: