Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Critical Exploit: Negative Price Impact Incorrectly Increases Depositor’s Share Allocation

manga

The most severe flaw in the contract lies in how it manually adjusts a depositor’s effective deposit amount by applying GMX’s price impact in the callback. Specifically, the logic inside afterOrderExecution for a MarketIncrease order contains a miscalculation that can be exploited to mint an inflated number of shares.

if (orderResultData.orderType == Order.OrderType.MarketIncrease) {
// ...
uint256 feeAmount = vaultReader.getPositionFeeUsd(market, orderResultData.sizeDeltaUsd, false) / prices.shortTokenPrice.min;
int256 priceImpact = vaultReader.getPriceImpactInCollateral(curPositionKey, orderResultData.sizeDeltaUsd, prevSizeInTokens, prices);
uint256 increased;
if (priceImpact > 0) {
increased = amount - feeAmount - uint256(priceImpact) - 1;
} else {
increased = amount - feeAmount + uint256(-priceImpact) - 1;
}
_mint(counter, increased, false, prices);
// ...
}

The logic incorrectly treats negative price impact as a positive addition when computing increased, which determines the number of vault shares minted.

In GMX:

Negative price impact means the user is receiving less value because their trade is large relative to liquidity or due to slippage.
The vault should reduce the effective deposit when a negative price impact occurs.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!