# Underestimated gas estimation for executing withdrawals leads to insufficient keeper compensation

GMX's estimateExecuteWithdrawalGasLimit omits token-swap gas, so withdrawal execution fees are underpriced and keepers are undercompensated for gas spent.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: 0xAmanda
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/195
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** GMX Synthetics GasUtils / WithdrawalUtils contracts
**Root cause:** estimateExecuteWithdrawalGasLimit returns only a static withdrawal gas limit plus callback gas limit, ignoring the token swaps performed in _executeWithdrawal, unlike estimateExecuteDepositGasLimit which accounts for swaps.
**Steps:**
1. Read `GasUtils.estimateExecuteWithdrawalGasLimit`: returns `withdrawalGasLimitKey(false)` + `callbackGasLimit()` only
2. Compare with `GasUtils.estimateExecuteDepositGasLimit`, which adds swap gas
3. Note `WithdrawalUtils._executeWithdrawal` performs token swaps at lines 354 and 365
4. Observe `createWithdrawal` L163-164 uses this underestimated limit in `validateExecutionFee`
5. Create a withdrawal with swaps enabled and pay only the underestimated executionFee; keeper executes and is underpaid
**How found:** Code-reading comparison of the deposit vs withdrawal gas estimation functions revealed the withdrawal path omits swap gas that the deposit path includes, then traced where the estimate gates executionFee validation.
**Insight:** When auditing fee/gas estimation, diff sibling functions (deposit vs withdrawal, mint vs redeem) for asymmetric cost components — any branch that adds swaps, callbacks, or hooks in execution must be mirrored in the estimator that gates fee validation.