# No slippage for withdrawal without swapping path

GMX withdrawal without swap path skips minLongTokenAmount/minShortTokenAmount slippage checks, letting frontrunners sandwich users and cause fund loss.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: bin2chen
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/70
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-19
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GMX Synthetics WithdrawalUtils/SwapUtils withdrawal flow
**Root cause:** WithdrawalUtils._executeWithdrawal calls SwapUtils.swap with minOutputAmount but never verifies minLongTokenAmount/minShortTokenAmount when no swap path is supplied; SwapUtils.swap only enforces slippage when a swap path exists.
**Steps:**
1. User calls withdrawal with LP amount and minLongTokenAmount/minShortTokenAmount but empty longTokenSwapPath/shortTokenSwapPath.
2. WithdrawalUtils._executeWithdrawal computes output amounts and calls SwapUtils.swap with minOutputAmount.
3. SwapUtils.swap sees empty path and sends tokens directly to receiver without checking minOutputAmount.
4. No post-swap check of minLongTokenAmount/minShortTokenAmount occurs in _executeWithdrawal.
5. Attacker frontruns the withdrawal transaction to move market price, causing user to receive less than their stated minimum.
**How found:** Code reading of WithdrawalUtils._executeWithdrawal and SwapUtils.swap: noticed slippage check only runs inside the swap-path branch, and no explicit minLongTokenAmount/minShortTokenAmount validation exists after the call.
**Exploitation:** Attacker observes pending withdrawal tx with no swap path, frontruns with a trade that skews the market price, the victim's withdrawal executes at the worse price with no slippage revert, attacker backruns to profit at the victim's expense.
**Insight:** When a function has two branches (with/without swap path), verify slippage/limit checks are enforced on both; the no-op branch often bypasses minOutputAmount enforcement entirely.