Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No Min Output Threshold

ChainDefenders

Summary

The contract PerpetualVault has a vulnerability in the _doGmxSwap function where there is no validation on the minOutputAmount parameter. This can lead to high slippage if the keeper provides a low minOutputAmount.

Vulnerability Details

In the _doGmxSwap function, the contract performs a GMX swap using the following code:

(address[] memory gPath, uint256 amountIn, uint256 minOutputAmount) = abi.decode(data, (address[], uint256, uint256));
swapProgressData.remaining = amountIn;
swapProgressData.isCollateralToIndex = isCollateralToIndex;
​
address tokenIn;
if (isCollateralToIndex) {
tokenIn = address(collateralToken);
} else {
tokenIn = address(indexToken);
}
IERC20(tokenIn).safeTransfer(address(gmxProxy), amountIn);
​
IGmxProxy.OrderData memory orderData = IGmxProxy.OrderData({
market: address(0),
indexToken: address(0),
initialCollateralToken: tokenIn,
swapPath: gPath,
isLong: isCollateralToIndex,
sizeDeltaUsd: 0,
initialCollateralDeltaAmount: 0,
amountIn: amountIn,
callbackGasLimit: callbackGasLimit,
acceptablePrice: 0,
minOutputAmount: minOutputAmount
});
_gmxLock = true;
gmxProxy.createOrder(orderType, orderData);

There is no validation on the minOutputAmount parameter. If the keeper provides a low minOutputAmount, it can lead to high slippage during the swap, resulting in a significant loss of value.

Impact

Without validation on the minOutputAmount, the contract is vulnerable to high slippage during swaps. This can result in significant financial losses for the vault if the keeper provides a low minOutputAmount, leading to a poor exchange rate and loss of value.

Tools Used

Manual Review

Recommendations

Introduce a threshold for the minOutputAmount parameter and validate it before performing the swap. This ensures that the minOutputAmount is within an acceptable range, preventing high slippage and protecting the vault from significant financial losses.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_swap_slippage_and_deadline

Slippage and deadline are handled externally. Paraswap implementation used by the current code (behind the proxy): https://etherscan.io/address/0xdffd706ee98953d3d25a3b8440e34e3a2c9beb2c GMX code: https://github.com/gmx-io/gmx-synthetics/blob/caf3dd8b51ad9ad27b0a399f668e3016fd2c14df/contracts/order/OrderUtils.sol#L150C15-L150C33

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!