External Data (Prices and gmxReader) Without Internal Sanity Checks
VaultReader.sol
Observation:
Functions such as getPositionInfo, getPriceImpactInCollateral, and getPnl accept a MarketPrices struct (which includes fields like prices.shortTokenPrice.min and prices.indexTokenPrice.min) without any internal validation of those values. Similarly, all calls to gmxReader.getPositionInfo assume that the returned PositionInfo is within expected bounds.
Impact:
If, for any reason, the provided prices (or data from gmxReader) are zero, extremely high, or otherwise invalid, the calculations (net value, fee assessments, pnl, price impact) could become incorrect. This misreporting would directly affect any logic that depends on these view functions for risk management or fee calculation.
Validation:
The absence of require statements or sanity checks on critical price fields is evident. Although these functions are “view” functions, if their outputs are used in off‑chain decision making (or as part of further on‑chain calculations), inaccuracies can be propagated.
Recommendation:
If these view functions are used to drive financial decisions, incorporate minimal internal bounds checks (for example, require that key price fields are nonzero and within an acceptable range) to ensure the integrity of the reported data.
Lead Judging Commences
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Suppositions
There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.
Users mistake, only impacting themselves.
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.