# The protocol doesn’t check whether the orders have expired when the mid and impact price are calculated

GTE perps markPrice uses expired CLOB orders in mid/impact price, letting an attacker post near-expiry orders to skew markPrice, funding, and liquidations.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: dimulski
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Perps Market markPrice / CLOB order book (Market.sol)
**Root cause:** Market.setMarkPrice() computes mid price and impact price from best bid/ask without filtering expired orders, so orders that will be removed at matching still influence the price.
**Steps:**
1. Observe ETH market: markPrice 4000e18, best bid 3990e18, best ask 4010e18, each 1e18.
2. At block.timestamp 10, submit a SELL order at 3991e18 expiring at block.timestamp 11.
3. At block.timestamp 11 admin calls `Market.setMarkPrice()`; indexPrice 4004e18.
4. Mid price computed as (3990e18+3991e18)/2 = 3990.5e18 instead of 4000e18; basis spread becomes -13.5e18 instead of -4e18.
5. Impact price via `Market::getImpactPrice()` also ~3990.5e18 instead of 4000e18.
6. Median of index/impact/TWAP sets markPrice to 3990.5e18; repeat each block to poison TWAP/EMA entries.
**How found:** Code reading of Market.setMarkPrice()/getImpactPrice() noting no expiry check on orders feeding mid/impact price, then constructed a numeric scenario showing markPrice deviation.
**Exploitation:** Attacker posts a near-expiry order inside the spread each block so the markPrice snapshot and impact price are computed from a price that will be removed at matching; repeated submissions poison TWAP and basis-spread EMA, shifting funding rates and triggering wrongful liquidations.
**Escalation:** Repeating the order every block (or manipulating ~10% of TWAP entries) degrades TWAP/EMA mitigation, amplifying markPrice deviation.
**Insight:** When an oracle derives price from an order book, check whether orders that will be removed at matching (expired, or about to be filled) are excluded from the price feed; near-expiry orders inside the spread are a cheap lever to skew TWAP/EMA.