medium

Incorrect state transition may cause vault in stuck

Contest
Reward

Total

226.63 USDC

30.63 USDC
30.63 USDC
Selected
42.88 USDC
30.63 USDC
30.63 USDC
30.63 USDC
30.63 USDC
Selected Submission

Incorrect state transition may cause vault in stuck

Severity

High Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXCompound.sol#L127-L136

Summary

Incorrect state transition may cause vault in stuck under processCompoundCancellation scenario.

Vulnerability Details

When keeper execute compound action and GMXCallback return afterDepositCancellation action, then protocol will call GMXCompound#processCompoundCancellation function to change vault status.

However, vault status is changed to GMXTypes.Status.Compound_Failed instead of GMXTypes.Status.Open by GMXCompound#processCompoundCancellation function, which is different with document described below:

https://github.com/Cyfrin/2023-10-SteadeFi/blob/main/docs/sequences/strategy-gmx-compound-sequence-detailed.md

and All scenarios should be handled to ensure vault eventually returns to an Open status. Consider how a scenario might lead to a stuck vault (other statuses).

Impact

Vault may stuck in unexpected state after processCompoundCancellation action.

Tools Used

vscode, Manual Review

Recommendations

Change the vault status to Open instead of Compound_Failed when call GMXCompound#processCompoundCancellation function.