Liquidity Management

Summary

PerpetualVault contracts directly use tx.gasprice for calculating execution fees. This allows malicious users to manipulate the gas price when initiating transactions, potentially paying insufficient fees or causing denial-of-service conditions.

Vulnerability Details

The vulnerability exists in several locations where tx.gasprice is used to calculate execution fees:

For fee refund calculations in PerpetualVault._mint():

And similarly in PerpetualVault._handleReturn():

The issue is that tx.gasprice is a transaction-level property set by the original transaction sender, and it persists throughout the entire transaction execution regardless of which contracts are calling each other. This means users can manipulate this value to their advantage when interacting with the protocol.

Impact

This vulnerability can lead to several serious issues:

1. Insufficient Execution Fees: A user could set an abnormally low gas price when calling deposit(), resulting in insufficient fees being collected to cover GMX execution costs.

2. Economic Loss: The protocol might need to cover the difference between the collected execution fees and the actual cost of executing orders on GMX.

3. Denial of Service: In extreme cases, if the collected fees are too low, GMX keepers might not execute the orders at all, causing operations to stall.

4. Fee Miscalculation: In the case of fee refunds, an abnormally high gas price could lead to large refunds that don't reflect the actual execution cost.

The most direct attack vector is through the PerpetualVault.deposit() function, which is directly callable by users:

A user calling this function with a manipulated gas price would affect the fee calculations in _payExecutionFee().

Tools Used

Manual code review

Recommendations

The most robust mitigation would be to implement a gas price oracle system that provides reliable gas price data for both Arbitrum and Avalanche networks, as the protocol will be deployed on both platforms.