Liquidity Management

Summary

The createOrder and settle functions do not fully validate the order data, such as checking for negative values or ensuring the data is not stale.

Vulnerability Details

The vulnerability can be found in the lines of code below;

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/interfaces/IGmxProxy.sol#L47

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/interfaces/IGmxProxy.sol#L48

Proof of Concept (PoC):

• An attacker submits an order with invalid parameters, such as a negative size delta or stale data.

• The createOrder or settle functions use the invalid data to execute orders, leading to incorrect executions.

• Example:

  function createOrder(Order.OrderType orderType, OrderData memory orderData) external returns (bytes32) {
  // GMX-specific logic
  }

  If orderData contains invalid parameters, the order execution will be incorrect.

Impact

Insufficient validation could lead to incorrect order executions and protocol instability.

Tools Used

Recommendations

• Add checks for negative values and ensure the order data is not stale.

• Implement additional validation mechanisms to ensure data accuracy.