Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`_cancelFlow` in PerpetualVault, could be not executeable

ChainDefenders

Summary

The cancelFlow function in the PerpetualVault contract could revert due to the use of safeTransfer when transferring collateral tokens. If a token receiver is blacklisted between the deposit and the cancel order, the transfer will fail, preventing the function from executing successfully.

Relevant Code Snippet

function _cancelFlow() internal {
if (flow == FLOW.DEPOSIT) {
uint256 depositId = counter;
collateralToken.safeTransfer(depositInfo[depositId].owner, depositInfo[depositId].amount); // Possible revert if token is blacklisted
totalDepositAmount = totalDepositAmount - depositInfo[depositId].amount;
EnumerableSet.remove(userDeposits[depositInfo[depositId].owner], depositId);
try IGmxProxy(gmxProxy).refundExecutionFee(
depositInfo[counter].owner,
depositInfo[counter].executionFee
) {} catch {}
delete depositInfo[depositId];
} else if (flow == FLOW.WITHDRAW) {
try IGmxProxy(gmxProxy).refundExecutionFee(
depositInfo[counter].owner,
depositInfo[counter].executionFee
) {} catch {}
}
// Setting flow to liquidation has no meaning.
// The aim is to run FINALIZE action (swap indexToken to collateralToken).
flow = FLOW.LIQUIDATION;
nextAction.selector = NextActionSelector.FINALIZE;
}

Vulnerability Details

  • The function calls safeTransfer(collateralToken, recipient, amount), which relies on the token contract’s implementation of transfer().

  • If the token receiver gets blacklisted, because the protocol is using USDC

Impact

  • Denial of Service (DoS): A blacklisted receiver can make cancelFlow revert.

Tools Used

Manual Review

Recommendations

Add try/catch to prevent this problem.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_cancelFlow_blacklisted

Likelihood: Extremely Low, when user is blacklisted between the deposit/withdraw and cancelFlow is called by the Keeper. Impact: Medium/High, cancelFlow DoS.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!