# The redeem related functions are likely to be blocked

PirexGmx shares GMX's per-user cooldownDuration on GLP unstake, so any concurrent deposit blocks all users' redeemPxGlp calls, enabling cheap griefing DoS.

- Payout: Contest reward
- Severity: high
- Program: Redacted Cartel
- Credited: KingNFT
- Disclosed: 2023-01-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-redactedcartel-findings/issues/113
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** PirexGmx.sol redeem functions interacting with GMX GlpManager
**Root cause:** GMX GlpManager enforces cooldownDuration per caller (the PirexGmx contract), so any deposit/stake via PirexGmx within the cooldown window makes _removeLiquidity revert for all Pirex users sharing that contract address.
**Steps:**
1. Observe GMX GlpManager._removeLiquidity reverts if block.timestamp < lastAddedAt[msg.sender] + cooldownDuration
2. Note PirexGmx is a single msg.sender to GlpManager, so all users share one lastAddedAt
3. Any user calls depositGlp/depositGlpETH with 1 wei GLP, resetting lastAddedAt
4. Within cooldownDuration (15 min, max 2 days), call redeemPxGlp/redeemPxGlpETH/_redeemPxGlp -> reverts
5. Repeat deposit every 15 min to sustain DoS at ~$9.6/day (~$3.5k/year) gas cost
**How found:** Read GMX GlpManager cooldown logic and realized PirexGmx aggregates many users under one address, so a per-user cooldown becomes a shared global lock; modeled failure probability with Poisson distribution and estimated griefing cost from Arbitrum gas history.
**Exploitation:** Attacker deposits 1 wei GLP via PirexGmx every cooldownDuration interval, keeping lastAddedAt fresh so no Pirex user can redeem; cost is only gas (~$0.1/tx on Arbitrum).
**Escalation:** Even without an attacker, organic deposit volume from other users probabilistically blocks redemption (95% failure at 10% user share); GMX raising cooldownDuration to 2 days worsens it.
**Insight:** When integrating a protocol that enforces per-address rate limits/cooldowns, check whether your contract aggregates many users under one address — a per-caller restriction becomes a cheap shared DoS vector; quantify with arrival-rate math and gas cost.