Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Fetching indexToken.balanceOf() will always revert for BTC market

wellbyt3

Summary

Due to the BTC/USD market returning a non-contract address as indexToken, any calls to balanceOf() in PerpetualVault.sol revert, rendering the contracts incompatible with this key GMX market.

Vulnerability Details

When a PerpetualVault is initialized, the indexToken address is set by calling getMarket() from the GMXReader:

// PerpetualVault.sol::initialize()
function initialize(
address _market,
address _keeper,
address _treasury,
address _gmxProxy,
address _vaultReader,
uint256 _minDepositAmount,
uint256 _maxDepositAmount,
uint256 _leverage
) external initializer {
...SNIP...
​
MarketProps memory marketInfo = IVaultReader(_vaultReader).getMarket(market);
@> indexToken = marketInfo.indexToken;
​
...SNIP...
}
​
// VaultReader.sol::getMarket()
function getMarket(address market) public view returns (MarketProps memory) {
@> return gmxReader.getMarket(address(dataStore), market);
}

According to the README, these contracts should be compatible with wBTC (i.e. the BTC/USD GMX market). However, in the BTC/USD market, marketinfo.indexToken is not a contract, so calling balanceOf() will revert.

Here's the indexToken address for the BTC/USD market on Arbitrum: https://arbiscan.io/address/0x47904963fc8b2340414262125af798b9655e58cd

indexToken.balanceOf() is used throughout the PerpetualVault.sol contract making Gamma's implementation incompatible with this key market.

Impact

Contracts incompatible with key GMX market.

Tools Used

Manual review

Recommendations

Consider using the long token instead of the index token for these markets, however, this can cause issues if you ever want to launch on markets where the long token doesn't equal the index token.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

wellbyt3 Submitter
9 months ago
n0kto Lead Judge
8 months ago
n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_WBTC_market_set_indexToken_on_an_EOA

Impact: High. 1/3 of the in-scope tokens are DoS, and WBTC is an important token. Likelihood: Low. It would be an admin error to integrate it, knowing that indexToken should be equal to longToken. However, the token is in-scope, meaning it should have at least a low likelihood.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!