Liquidity Management

Summary

The refundExecutionFee function in the GmxProxy contract allows any address set as perpVault to refund ETH, posing a risk if the perpVault is compromised.

Vulnerability Details

The refundExecutionFee function allows the perpVault address to refund ETH to any recipient address. If the perpVault contract is compromised or maliciously manipulated, it can call this function to transfer ETH from the GmxProxy contract to any address, leading to potential loss of ETH.

Root Cause:
The refundExecutionFee function lacks robust access control, allowing any address set as perpVault to refund ETH. If the perpVault contract is compromised, it poses a risk of potential loss of ETH due to unauthorized transfers.

Proof of Concept:

1. Code Analysis:

   function refundExecutionFee(address receipient, uint256 amount) external {

   require(msg.sender == perpVault, "invalid caller");

   payable(receipient).transfer(amount);

   }

2. Example Scenario:

   • Compromised perpVault:

     • Assume the perpVault contract is compromised by an attacker.

     • The attacker can call the refundExecutionFee function with their address as the recipient and a large amount of ETH.

   • Unauthorized ETH Transfer:

     • The refundExecutionFee function transfers the specified amount of ETH to the attacker's address.

     • This results in a loss of ETH from the GmxProxy contract.

3. Unit Test:

   function test_RefundExecutionFee() external {

   address attacker = makeAddr("attacker");

   address compromisedPerpVault = makeAddr("compromisedPerpVault");

   ​

   // Set the compromisedPerpVault as the perpVault

   GmxProxy(gmxProxy).setPerpVault(compromisedPerpVault, market);

   ​

   // Fund the GmxProxy contract with some ETH

   vm.deal(address(gmxProxy), 10 ether);

   ​

   // Attempt to refund ETH to the attacker's address

   vm.prank(compromisedPerpVault);

   GmxProxy(gmxProxy).refundExecutionFee(attacker, 5 ether);

   ​

   // Check the attacker's balance

   assertEq(attacker.balance, 5 ether);

   }

Impact

Potential loss of ETH if the perpVault contract is maliciously manipulated. This can result in unauthorized transfers of ETH from the GmxProxy contract to an attacker's address.

Tools Used
manual

Recommendations

To mitigate the risk of unauthorized ETH transfers, consider implementing additional access control mechanisms and security measures. One approach is to use a multi-signature wallet or a more secure access control mechanism for the perpVault address. Additionally, consider adding checks to ensure that the recipient address is authorized to receive the refund: