Liquidity Management

Summary

The getNegativeFundingFeeAmount function does not fully validate the funding fee data returned by GMX, such as checking for negative values or ensuring the data is not stale

Vulnerability Details

The vulnerability can be found in the lines of code below;

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/VaultReader.sol#L63-L71

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/VaultReader.sol#L112-L113

Proof of Concept (PoC):

• GMX returns incorrect funding fee data due to a bug or manipulation.

• The getNegativeFundingFeeAmount function uses the incorrect data to calculate funding fees, leading to incorrect valuations.

• Example:

  return positionInfo.fees.funding.fundingFeeAmount;

  If fundingFeeAmount is incorrect, the funding fee calculation will be wrong.

Impact

Incorrect calculations could lead to financial losses and protocol instability

Tools Used

Deepseek

Recommendations

• Add checks for negative values and ensure the funding fee data is not stale.

• Implement additional validation mechanisms to ensure data accuracy.