M-30. A depositor of the GMXVault can bypass paying the fee when the depositor deposit into the GMXVault.

plain text
/**
* @notice @inheritdoc GMXVault
* @param self GMXTypes.Store
* @param isNative Boolean as to whether user is depositing native asset (e.g. ETH, AVAX, etc.)
*/
function deposit(
GMXTypes.Store storage self,
GMXTypes.DepositParams memory dp,
bool isNative
) external {
...
self.status = GMXTypes.Status.Deposit;

self.vault.mintFee();    ///<----------------------- @audit
...

plain text
/**
* @notice Mint vault token shares as management fees to protocol treasury
*/
function mintFee() public {
_mint(_store.treasury, GMXReader.pendingFee(_store)); ///<------------ @audit
_store.lastFeeCollected = block.timestamp;
}

plain text
/**
* @notice @inheritdoc GMXVault
* @param self GMXTypes.Store
*/
function processDeposit(
GMXTypes.Store storage self
) external {
GMXChecks.beforeProcessDepositChecks(self);

// We transfer the core logic of this function to GMXProcessDeposit.processDeposit()
// to allow try/catch here to catch for any issues or any checks in afterDepositChecks() failing.
// If there are any issues, a DepositFailed event will be emitted and processDepositFailure()
// should be triggered to refund assets accordingly and reset the vault status to Open again.
try GMXProcessDeposit.processDeposit(self) {
// Mint shares to depositor
self.vault.mint(self.depositCache.user, self.depositCache.sharesToUser); ///<------------- @audit
...

• Foundry