# WNT in depositVault can be drained by abusing initialLongToken/initialShortToken of CreateDepositParams

createDeposit trusts caller-supplied initialLongToken/initialShortToken, letting attacker inflate executionFee and drain WNT from depositVault via cancelDeposit refund.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: bin2chen
- Disclosed: 2022-09-22
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/205
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** GMX Synthetics ExchangeRouter createDeposit / DepositUtils
**Root cause:** createDeposit subtracts executionFee from initialLongTokenAmount/initialShortTokenAmount based on market.longToken/shortToken==wnt rather than the actual params.initialLongToken/initialShortToken, so a cheap token can be passed as initialLongToken while executionFee is deducted as if it were WNT.
**Steps:**
1. Attacker sends cheap token (e.g. USDC) to depositVault via `sendTokens`
2. Calls `createDeposit` with `initialLongToken=usdc`, `initialShortToken=market.shortToken`, `executionFee=vaultWNTBalance`, market where longToken==wnt
3. DepositUtils subtracts executionFee from initialLongTokenAmount (USDC) since market.longToken==wnt, recording a large WNT executionFee
4. Calls `cancelDeposit(depositKey)` to receive executionFee in WNT, draining depositVault
**How found:** Code review of DepositUtils.createDeposit noticed the executionFee deduction branches on market.longToken/shortToken==wnt instead of the caller-supplied initialLongToken/initialShortToken, revealing a mismatch between the token actually transferred and the token the fee is denominated in.
**Exploitation:** Attacker funds depositVault with a cheap token, sets executionFee to the entire WNT balance of the vault, creates a deposit against a WNT-long market, then cancels to be refunded executionFee in WNT, netting the vault's WNT for near-zero cost.
**Insight:** When a function deducts a native/WNT-denominated fee, verify the branch condition checks the same token variable that was actually transferred in, not a market-level token field; mismatches let attackers pick a cheap token to satisfy the fee accounting.