Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Stale Data Usage in Position Calculations

0xkimonic

Summary

The function relies on gmxReader.getPositionInfo() and dataStore without ensuring real-time price updates, leading to potentially outdated position values.

Vulnerability Details

The VaultReader contract uses prices.shortTokenPrice.min and prices.longTokenPrice.min, which may be stale if not updated frequently.

Borrowing fees and funding fees are subtracted without verifying time-based freshness.

POC

  1. Call getPositionInfo() multiple times without updating dataStore.

  2. Compare results with on-chain updated prices.

  3. If price changes are not reflected, the data is stale.

// Assume outdated price data is used
uint256 netValueOld = vaultReader.getPositionInfo(key, oldPrices).netValue;
uint256 netValueNew = vaultReader.getPositionInfo(key, newPrices).netValue;
​
// If outdated prices were used, these values would be different
assert(netValueOld != netValueNew);
​

Impact

Users may see incorrect liquidation warnings.

Delayed position updates can cause traders to enter bad trades.

If borrowing fees are not updated, the vault might be under/over-compensating.

Tools Used

Manual Review
Foundry

Recommendations

  1. Ensure real-time price updates before position calculations.

  2. Implement on-chain timestamp validation for price freshness.

  3. Use Chainlink oracles to verify updated price feeds.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!