Liquidity Management

Summary

The Gamma protocol's _createIncreasePosition function fails to validate whether the collateral provided for an order will be sufficient according to GMX's requirements. This omission allows orders to be created and submitted to GMX, but they will revert during execution if collateral is insufficient. Orders remain stuck in the system until the REQUEST_EXPIRATION_TIME elapses, forcing users to wait to cancel them, disrupting protocol functionality.

Vulnerability Details

Root Cause

1. Missing Pre-Execution Collateral Check
   In GMX, the function IncreasePositionUtils._increasePositionValidation (L182-196) validates collateral sufficiency using willPositionCollateralBeSufficient. This check ensures that after accounting for fees (execution, borrowing, etc.), the remaining collateral meets GMX's minimum requirements.
   Gamma Protocol Code Gap:
   The Gamma protocol's _createIncreasePosition transfers collateral and creates orders but does not replicate GMX's collateral checks. Orders are created optimistically, assuming fees/collateral will be valid at execution time.

https://github.com/gmx-io/gmx-synthetics/blob/b8fb11349eb59ae48a1834c239669d4ad63a38b5/contracts/position/IncreasePositionUtils.sol#L182-L196

2. Stuck Orders Due to GMX Reverts
   When the order reaches GMX for execution, the willPositionCollateralBeSufficient check fails, causing the transaction to revert. GMX marks the order as "failed," but Gamma does not handle this state. The order remains in the system until REQUEST_EXPIRATION_TIME passes, blocking users from retrying or recovering funds.

Impact

Users cannot execute or cancel orders immediately, locking collateral for REQUEST_EXPIRATION_TIME (e.g., 1 hour). During volatile markets, this could lead to missed opportunities or losses.

Recommendations

Add additional validation to increasePosition to ensure there are enough funds.