Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing GMX feature check leads to halted protocol functionality

0xl33

Description:

In GmxProxy::settle function there should be a check which ensures that GMX order execution feature is enabled, just like it is checked in GmxProxy::createOrder function:

// check if execution feature is enabled
bytes32 executeOrderFeatureKey = keccak256(abi.encode(EXECUTE_ORDER_FEATURE_DISABLED, orderHandler, orderType));
require(dataStore.getBool(executeOrderFeatureKey) == false, "gmx execution disabled");

I am aware that the same issue was found in the previous audit by Guardian, but I believe this finding and its duplicates should be counted as valid, because in the current implementation, this issue occurs in a different function (in the last audit report, it was found in GmxProxy::createOrder function) and the sponsors obviously have not noticed it, which means it is not known by them that it still exists.

Impact:

When order execution is disabled, GMX orders will still successfully be created, but will not be executed until the feature is enabled again, due to the feature validation in OrderHandler::_executeOrder. This leads to halted protocol functionality until owner cancels the order (cancel order feature can also be disabled).

Recommended Mitigation:

Add the same GMX feature check from createOrder function to settle function:

function settle(IGmxProxy.OrderData memory orderData) external returns (bytes32) {
require(msg.sender == perpVault, "invalid caller");
uint256 positionExecutionFee =
getExecutionGasLimit(Order.OrderType.MarketDecrease, orderData.callbackGasLimit) * tx.gasprice;
require(address(this).balance >= positionExecutionFee, "insufficient eth balance");
+ bytes32 executeOrderFeatureKey = keccak256(abi.encode(EXECUTE_ORDER_FEATURE_DISABLED, orderHandler, orderType));
+ require(dataStore.getBool(executeOrderFeatureKey) == false, "gmx execution disabled");
gExchangeRouter.sendWnt{value: positionExecutionFee}(orderVault, positionExecutionFee);
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_execution_feature_not_checked

Likelihood: Low, when the execution is disabled on GMX. Impact: Low/Medium, cyclic settlement/cancelOrder loop.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!