Liquidity Management

The core issue in this snippet is that it miscalculates the USD value of a token amount by multiplying the token amount by its price without adjusting for the 10³⁰ “price precision” factor.

In GMX-style contracts, prices are stored in fixed-point 10³⁰ format (e.g., a price of $1 is actually stored as 1 * 10^30). When converting a token amount to its USD value, the correct approach is:

USD Value=Token Amount×Price (10³⁰)1030\text{USD Value} = \frac{\text{Token Amount} \times \text{Price (10³⁰)}}{10^{30}}

However, in the function willPositionCollateralBeSufficient, the calculation omits this division, leading to an overestimated collateral value in USD.

Bug Location willPositionCollateralBeSufficient

• collateralTokenPrice.min is stored in 10³⁰ format.

• values.positionCollateralAmount is a raw token amount (without 10³⁰ scaling).

• Multiplying them directly over-scales the result by 10³⁰, instead of returning the correct USD value.

The correct approach is to divide by 10³⁰ after multiplication to maintain the proper USD scale:

where:

Severely Overestimates Collateral

Allows Undercollateralized Positions

Potential Exploit Scenario

To correctly compute remainingCollateralUsd, apply division by 10³⁰ to bring the result back to USD precision:

This critical vulnerability causes the system to massively overestimate collateral due to a missing precision adjustment, allowing undercollateralized positions to pass validation. Properly scaling the calculation by dividing by 10³⁰ ensures accurate collateral tracking and prevents potential exploits that could drain the system’s liquidity.