IllIllI - Virtual swap impacts can be bypassed by swapping through markets where only one of the collateral tokens has virtual inventory

[sherlock-admin]

IllIllI

medium

Virtual swap impacts can be bypassed by swapping through markets where only one of the collateral tokens has virtual inventory

Summary

Virtual swap impacts can be bypassed by swapping through markets where only one of the collateral tokens has virtual inventory

Vulnerability Detail

The code that calculates price impacts related to swapping, skips the application of virtual impacts if one of the tokens doesn't have a virtual token set

Impact

If the virtual swap amount for a particular token is very large, and a large swap through that market would cause the balance to drop a lot, causing the trade to have a large negative impact, a user can split their large order into multiple smaller orders, and route them through other markets where there is no virtual token for one of the pools, and avoid the fees (assuming those pools have non-virtual imbalances that favor such a trade).

Code Snippet

Virtual impacts are completely skipped if one of the tokens doesn't have a virtual version:

// File: gmx-synthetics/contracts/pricing/SwapPricingUtils.sol : SwapPricingUtils.getPriceImpactUsd()   #1

113            (bool hasVirtualInventoryTokenB, uint256 virtualPoolAmountForTokenB) = MarketUtils.getVirtualInventoryForSwaps(
114                params.dataStore,
115                params.market.marketToken,
116                params.tokenB
117            );
118    
119            if (!hasVirtualInventoryTokenA || !hasVirtualInventoryTokenB) {
120 @>             return priceImpactUsd;
121:           }

https://github.com/sherlock-audit/2023-04-gmx/blob/main/gmx-synthetics/contracts/pricing/SwapPricingUtils.sol#L113-L121

Tool used

Manual Review

Recommendation

Use the non-virtual token's inventory as the standin for the missing virtual inventory token

[xvi10]

fixed in gmx-io/gmx-synthetics@1b35173

virtual swap price impact should be tracked by virtualInventoryForSwapsKey(virtualMarketId, isLongToken) instead of virtualInventoryForSwapsKey(virtualMarketId, token)

this would allow similar markets e.g. ETH/USDC, ETH/USDT to be associated together