025.md

caventa

medium

Deposit and Withdrawal can be cancelled without sufficient time has passed from executeDeposit and executeWithdrawal

Summary

Deposit and Withdrawal can be cancelled without sufficient time has passed from executeDeposit and executeWithdrawal

Vulnerability Detail

    function validateRequestCancellation(
        DataStore dataStore,
        uint256 createdAtBlock,
        string memory requestType
    ) internal view {
        uint256 requestExpirationAge = dataStore.getUint(Keys.REQUEST_EXPIRATION_BLOCK_AGE);
        uint256 requestAge = Chain.currentBlockNumber() - createdAtBlock;

        if (requestAge < requestExpirationAge) {
            revert RequestNotYetCancellable(requestAge, requestExpirationAge, requestType);
        }
    }

validationRequestCancellation (See code above) is called when controller cancels deposit and withdrawal directly. However, if the contract is cancelled after exception is thrown in executeDeposit or executeWithdrawal, the checking is skipped

Impact

Deposit and withdrawal can be cancelled without sufficient time to be has passed if exception is thrown in executeDeposit or executeWithdrawal

Code Snippet

https://github.com/gmx-io/gmx-synthetics/blob/main/contracts/exchange/DepositHandler.sol#L71-L75 https://github.com/gmx-io/gmx-synthetics/blob/main/contracts/exchange/WithdrawalHandler.sol#L71-L75

Tool used

Manual Review

Recommendation

Add the validation in executeDeposit and executeWithdrawal