# Incomplete error handling causes execution and freezing/cancelling of Deposits/Withdrawals/Orders to fail.

Malformed revert data from user callback makes GMX's ErrorUtils.getRevertMessage revert, blocking keeper execution/cancellation/freezing of orders and deposits.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: 0xdeadbeef
- Disclosed: 2022-09-22
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/119
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-16
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** GMX Synthetics DepositHandler/OrderHandler callback error handling (ErrorUtils.getRevertMessage)
**Root cause:** getRevertMessage abi.decodes the revert payload after matching the Error(string) selector without validating the ABI offset/length, so a crafted offset (e.g. 0xffffffffffffff) makes abi.decode revert inside the catch block.
**Steps:**
1. Create a deposit/order with callbackContract set to an attacker contract and a callbackGasLimit.
2. In afterDepositExecution/afterOrderExecution (and cancellation/frozen callbacks), revert with assembly-crafted bytes: selector 0x08c379a0 followed by an oversized offset (0xffffffffffffff) and bogus length.
3. Keeper calls executeDeposit/executeOrder; the try/catch catches the revert, calls ErrorUtils.getRevertMessage, which abi.decodes and reverts.
4. Whole keeper transaction reverts; order/deposit stays in store and cannot be executed, cancelled, or frozen.
**How found:** Code review of the try/catch callback pattern: noticed getRevertMessage abi.decodes attacker-controlled revert bytes and reasoned that a crafted offset exceeding uint64 or encoded size would make abi.decode revert, turning error handling into a DoS.
**Exploitation:** Attacker selectively reverts with malformed data to block keepers from executing orders when unfavorable and unblock when profitable; also blocks freezeOrder so oversized limit orders can be filled after attacker deposits liquidity; repeated keeper attempts waste keeper gas since protocol promises to reimburse execution cost.
**Escalation:** Combining execution and cancellation blocking lets attacker game risk-free orders and drain keeper funds via repeated reverting transactions.
**Insight:** Whenever a contract abi.decodes an attacker-supplied revert reason inside a catch block, craft the offset/length fields to make the decode itself revert; user-controlled callback contracts are a reliable source of such payloads.