Summary

A critical accounting error exists in the afterOrderExecution callback when processing GMX MarketDecrease orders. The miscalculation of prevCollateralBalance leads to systematic underpayment of withdrawal amounts to users. This vulnerability stems from incorrect ordering of balance adjustment operations after receiving funds from GMX.

Vulnerability Details

Technical Background

When closing positions via MarketDecrease orders:

1. GMX returns collateral via orderResultData.outputAmount

2. Contract balance automatically increases before callback execution

3. prevCollateralBalance calculation attempts to track pre-operation state

Affected Code

Root Cause Analysis

The calculation assumes outputAmount was added to the balance after this line. However:

1. GMX transfers outputAmount before triggering callback

2. collateralToken.balanceOf() already includes outputAmount

3. Subtracting outputAmount creates an artificial undercount

Impact

1. Withdrawal calculations use inflated "previous" balance

2. Users receive less collateral than entitled

3. Protocol accrues unaccounted funds through systematic underpayment

Tools Used

manual review