Liquidity Management

Summary

The GmxProxy.setPerpVault function uses tx.origin == owner() for validation, which is vulnerable to phishing attacks.

Vulnerability Details

• tx.origin checks can be bypassed if the owner interacts with a malicious contract, allowing unintended perpVault assignment.

POC:

1. Attacker deploys a malicious contract:

   contract Phisher {

   function phish(GmxProxy gmxProxy) public {

   gmxProxy.setPerpVault(attackerVault, market);

   }

   }

2. Tricks the owner into calling Phisher.phish() (e.g., via a fake UI).

3. tx.origin becomes the owner’s address, setting perpVault to attackerVault.

4. Attacker drains funds via attackerVault.

Impact

An attacker could trick the owner into initiating a transaction that changes the perpVault address, leading to loss of funds or full control over the vault’s GMX positions.

Tools Used

Manual Review

Recommendations

Replace tx.origin with msg.sender for authorization checks.