# Keepers can be forced to waste gas with long revert messages

GMX callback revert strings are fetched and emitted, tripling gas cost beyond keeper estimates, letting attackers grief keepers and game price impact.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: 0xAmanda
- Disclosed: 2022-09-22
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/141
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-6
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** GMX Synthetics callback handling (CallbackUtils) and keeper gas estimation
**Root cause:** Callback failures fetch the revert message and emit it, so a callback using the full callbackGasLimit to build a long revert string consumes ~3x the gas budgeted in GasUtils.callbackGasLimit().
**Steps:**
1. Submit an order whose callback contract reverts with an extremely long string consuming the full `callbackGasLimit()`.
2. Keeper executes the order; callback runs with `{gas: order.callbackGasLimit()}` and reverts.
3. Catch block calls `ErrorUtils.getRevertMessage(reasonBytes)` and `emit AfterOrderCancellationError(...)`, each consuming comparable gas.
4. Total gas ~3x the estimated budget, exceeding keeper expectations.
**How found:** Code review of CallbackUtils try-catch: noticed revert message is both decoded and emitted, and compared against GasUtils.callbackGasLimit() budget, realizing the same gas is charged three times.
**Exploitation:** Attacker submits an order whose happy path succeeds but whose failure/frozen-order callback reverts with a long string, preventing freezing/execution until a favorable price, enabling price-impact gaming while forcing keepers to overspend gas.
**Escalation:** Chains griefing of keeper economics with price-impact manipulation by blocking the frozen-order callback path.
**Insight:** When auditing try-catch callback patterns, check whether revert data is decoded and re-emitted—each step re-charges gas against a budget sized for only the callback itself, enabling griefing via attacker-controlled revert strings.