logo
Submitted by Timenov, hunterw3b, Kodak, SBSecurity, Fides, mylifechangefast, SanketKogekar. Selected submission by: SBSecurity.

Relevant GitHub Links

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXDeposit.sol#L161
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXCompound.sol#L35
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXEmergency.sol#L72
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXManager.sol#L225
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXManager.sol#L244
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXRebalance.sol#L35
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXRebalance.sol#L149
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXVault.sol#L334
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWithdraw.sol#L231
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWorker.sol#L23
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWorker.sol#L72
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWorker.sol#L114
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXWorker.sol#L129

Summary

There are functions that don’t emit events.

Vulnerability Details

Functions:
GMXDeposit::processDepositFailure
GMXCompound::compound
GMXEmergency::emergencyResume
GMXManager::borrow
GMXManager::repay
GMXRebalance::rebalanceAdd
GMXRebalance::rebalanceRemove
GMXVault::mintFee
GMXWithdraw::processWithdrawFailure
GMXWorker::addLiquidity
GMXWorker::removeLiquidity
GMXWorker::swapExactTokensForTokens
GMXWorker::swapTokensForExactTokens

Impact

External users, frontend, or blockchain monitoring won’t announce for these critical functions.

Tools Used

Manual

Recommendations

Add events where possible for critical operations.
M-27. Missing fees allow cheap griefing attacks that lead to DoS
L-07. getsAmountsIn in GMXOracle hardcoded 15e14(15bps) for amountsIn would gives wrong amountsIn since GMX market has dynamic impact fee
Powered by Notaku
Share
Content
L-02. Lack of events for critical actions
Relevant GitHub Links
Summary
Vulnerability Details
Impact
Tools Used
Recommendations