Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Critical Price Validation Bug: longToken Checked Against Wrong Price Feed

manga

In the KeeperProxy contract, the _validatePrice function is designed to ensure that the on-chain Chainlink price matches the price submitted by the keeper for each relevant token (indexToken, longToken, and shortToken). However, there is a critical flaw in how the _check(...) function is called within _validatePrice.

function _validatePrice(address perpVault, MarketPrices memory prices) internal view {
...
​
// Retrieve market data from the vault
address market = IPerpetualVault(perpVault).market();
IVaultReader reader = IPerpetualVault(perpVault).vaultReader();
MarketProps memory marketData = reader.getMarket(market);
// Price validation checks
_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
​
// ⚠️ Incorrectly uses `prices.indexTokenPrice` instead of `prices.longTokenPrice`
_check(marketData.longToken, prices.indexTokenPrice.min);
_check(marketData.longToken, prices.indexTokenPrice.max);
​
// Correctly checks shortToken against shortTokenPrice
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);
}

Instead of validating the longToken price against its correct longTokenPrice, the contract mistakenly checks it against indexTokenPrice. This means:

  • marketData.longToken should be validated using prices.longTokenPrice.

  • marketData.longToken is incorrectly checked against prices.indexTokenPrice.

Incorrect Price Validation – The longToken is validated against an unrelated token’s price feed (indexToken), breaking the integrity of the price-checking mechanism.
Potential Exploits – A malicious keeper (or attacker, if additional security checks are weak) could manipulate the indexTokenPrice to pass incorrect prices for longToken, potentially leading to unfair liquidations, mispriced positions, or exploitative arbitrage opportunities.
Severe Economic Risk – If attackers can manipulate the perceived price of longToken, they can exploit miscalculations in collateral, liquidation thresholds, and order execution.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_validatePrice_no_check_for_longTokenPrice

Likelihood: None/Very Low, everytime the keeper send a price via run/runNextAction (sent by the Gamma keeper). Impact: Medium/High, does not check the longTokenPrice, it could go out of range. Keep in mind indexToken == longToken, an error from the keeper could be considered informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!