Skip to content
This repository has been archived by the owner on May 26, 2023. It is now read-only.

Latest commit

 

History

History
37 lines (21 loc) · 1.64 KB

006.md

File metadata and controls

37 lines (21 loc) · 1.64 KB

obront

medium

GLP price may be slightly understated due to GMX math error, which could lead to unfair liquidations

Summary

GMX has a disclosed math error in the contracts which lead to the GLP price being slightly overstated (up to ~0.6%). The GLPOracle relies on the faulty function, and should therefore compensate for this error to avoid unfair liquidations.

Vulnerability Detail

There is an error in GMX's calculation for the GLP price based on a miscalculation performed when closing short positions. The details of this issue are laid out here: https://twitter.com/BatchBrewCoder/status/1605291751476002816

GMX has responded to the disclosure, acknowledging the issue and setting a benchmark that GLP prices may be understated by approximately 0.6% on Arbitrum: https://twitter.com/GMX_IO/status/1605387484656832514

While 0.6% is a small amount, it may be the difference between a user being liquidated and not. For example:

  • A user puts 1000 USD into their Sentiment account
  • They borrow 4950 USD against it, believing to have buffer for a 1% drop in price
  • They convert their 1000 USD into GLP
  • The price of GLP falls just 0.4% and the user is liquidated

Impact

Users may be unfairly liquidated because GLP price is slightly lower than it should be.

Code Snippet

https://github.com/sherlock-audit/2023-01-sentiment/blob/main/oracle/src/gmx/GLPOracle.sol#L42-L45

Tool used

Manual Review

Recommendation

Do not launch a GLP Oracle until GMX has confirmed this issue is fully resolved. If necessary, add an owner controlled value into the contract that slightly increases the oracle price to ensure it accounts for this inaccuracy.