Liquidity Management

Summary

The PerpetualVault and GmxProxy contracts rely on a callbackGasLimit for GMX order execution and callbacks, set to 2,000,000 in PerpetualVault and calculated dynamically in GmxProxy. However, there’s no mechanism to dynamically adjust or validate this limit against network conditions or GMX requirements. If the gas limit is insufficient, callbacks could fail, stalling critical operations.

Vulnerability Details

• In PerpetualVault, callbackGasLimit is initialized to 2,000,000 and can be updated by the owner:

  solidity

  function setCallbackGasLimit(uint256 _callbackGasLimit) external onlyOwner {

  callbackGasLimit = _callbackGasLimit;

  }

• In GmxProxy, getExecutionGasLimit calculates the gas limit but lacks real-time adjustment for network gas price fluctuations:

  solidity

  function getExecutionGasLimit(Order.OrderType orderType, uint256 _callbackGasLimit) public view returns (uint256 executionGasLimit) {

  // ... calculation using static values and multiplier ...

  }

• There’s no monitoring or automatic adjustment based on current gas prices, GMX requirements, or historical execution data, risking underestimation of required gas.

Impact

• Callback Failures: Insufficient gas limits could cause afterOrderExecution or afterOrderCancellation callbacks to fail, delaying or preventing position updates, withdrawals, or liquidations.

• Operational Delays: Stalled operations could lead to financial losses, missed opportunities, or user dissatisfaction.

• Liquidation Risk: Failed callbacks might trigger unintended liquidations or leave positions unmanaged.

Tools Used

Manual code review

Recommendations

Implement dynamic adjustment of callbackGasLimit based on network conditions, GMX requirements, or historical data. Add a function for the owner to update with bounds