Liquidity Management

Summary

The getPositionInfo function does not fully validate the position data returned by GMX, such as checking for negative values or ensuring the data is not stale.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/VaultReader.sol#L48-L94

Proof of Concept (PoC):

• GMX returns incorrect position data due to a bug or manipulation.

• The getPositionInfo function uses the incorrect data to calculate position values, leading to incorrect valuations.

• Example:

  uint256 netValue =
  positionInfo.position.numbers.collateralAmount * prices.shortTokenPrice.min +
  positionInfo.fees.funding.claimableLongTokenAmount * prices.longTokenPrice.min +
  positionInfo.fees.funding.claimableShortTokenAmount * prices.shortTokenPrice.min -
  positionInfo.fees.borrowing.borrowingFeeUsd -
  positionInfo.fees.funding.fundingFeeAmount * prices.shortTokenPrice.min -
  positionInfo.fees.positionFeeAmount * prices.shortTokenPrice.min;

  If any of the values are incorrect, the netValue calculation will be wrong.

Impact

Insufficient validation could lead to incorrect position valuations and protocol instability.

Tools Used

Recommendations

• Add checks for negative values and ensure the position data is not stale.

• Implement additional validation mechanisms to ensure data accuracy.