# Preventing any user from calling the functions withdraw, redeem, or depositGmx in contract AutoPxGmx 

Attacker sends 1 gmxBaseReward token to AutoPxGmx, making compound's Uniswap swap revert on amountOutMinimum=1, blocking all withdraw/redeem/depositGmx calls.

- Payout: Contest reward
- Severity: medium
- Program: Redacted Cartel
- Credited: HE1M
- Disclosed: 2023-01-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-redactedcartel-findings/issues/70
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** AutoPxGmx vault contract (Solidity, Uniswap V3 swap in compound)
**Root cause:** compound() swaps the entire gmxBaseReward balance with amountOutMinimum=1; a tiny donated balance yields zero GMX out, reverting the swap and thus every function that calls compound.
**Steps:**
1. Observe withdraw/redeem/depositGmx all call `compound(poolFee, 1, 0, true)` with amountOutMinimum=1.
2. Wait until AutoPxGmx gmxBaseReward balance is 0 (just after a compound).
3. Transfer 1 gmxBaseReward directly to AutoPxGmx.
4. Victim calls withdraw; compound sees nonzero balance and calls `SWAP_ROUTER.exactInputSingle` with amountIn=1, amountOutMinimum=1.
5. Uniswap reverts `Too little received` since 1 gmxBaseReward < 1 GMX; victim tx reverts.
**How found:** Code reading of compound's swap parameters, noticing amountOutMinimum=1 combined with swapping the full token balance creates a revert condition on tiny balances.
**Exploitation:** Griefing DoS: attacker donates dust gmxBaseReward to the vault so the next compound swap fails the minOut check, reverting user withdrawals/deposits until balance accrues enough value.
**Insight:** When a contract swaps its entire token balance with a fixed minOut, any external dust donation can flip the swap into a revert; check whether minOut is reachable given arbitrary balanceIn.