Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Deposit flow global counter issue

hristoff_eth

Summary

The deposit flow relies on a global counter (counter) and associated state (e.g. depositInfo[counter]) for minting shares and refunding execution fees. This design assumes that deposits are processed strictly sequentially. However, if deposits are not handled sequentially or if flows overlap unexpectedly, the contract may reference the wrong deposit data.

Vulnerability Details

function _mint(uint256 depositId, uint256 amount, bool refundFee, MarketPrices memory prices) internal {
// Shares are minted based on depositInfo[depositId]
// However, fee refund logic uses depositInfo[counter] regardless of depositId.
if (refundFee) {
uint256 usedFee = callbackGasLimit * tx.gasprice;
if (depositInfo[counter].executionFee > usedFee) {
try IGmxProxy(gmxProxy).refundExecutionFee(depositInfo[counter].owner, depositInfo[counter].executionFee - usedFee) {} catch {}
}
}
}

Impact

Incorrect Share Calculations: May lead to misallocation of depositor shares.

Faulty Fee Refunds: Users might receive improper fee refunds.

State Inconsistencies: Overlapping flows could lock funds or dilute share values, undermining protocol integrity.

Tools Used

Manual code review.

Static analysis techniques.

Recommendations

Reference Accuracy: Modify the refund logic to reference the correct deposit using the provided depositId instead of the global counter.

Flow Isolation: Implement strict checks to prevent overlapping flows or asynchronous state modifications.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!