# When underlying collateral tokens are paused, orders can't be canceled

When a collateral token like USDC is paused, GMX order cancellation reverts on token refund, letting attackers front-run pauses and get a free option on price direction.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/167
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** GMX Synthetics OrderHandler / OrderUtils cancel flow
**Root cause:** Canceling a market increase/swap order refunds collateral in the same transaction; if the collateral token is paused, the refund reverts, so cancellation fails and the order stays live.
**Steps:**
1. Attacker bot detects an imminent token pause (e.g. USDC) and front-runs it with a large market increase order.
2. Keeper attempts execution; token paused so execution reverts and `_handleOrderError` calls `OrderUtils.cancelOrder`, which refunds collateral and reverts on the paused token.
3. Order remains pending with the original block number/price.
4. During the pause, attacker observes price movement; if favorable, lets keeper execute on unpause; if unfavorable, back-runs the pause with a cancel once token is unpaused.
**How found:** Code review of OrderHandler._handleOrderError and OrderUtils.cancelOrder, noticing that cancel refunds collateral in the same tx, which fails when the token is paused.
**Exploitation:** Attacker submits large market increase orders just before a collateral token pause. The keeper's cancel path reverts because refunding the paused token fails, so the order persists at the pre-pause price. Attacker then chooses to execute (if profitable) or cancel (if not), shifting risk to the counterparty.
**Insight:** In perp/DEX order systems, any cancel/refund path that touches an external token transfer can be blocked by token pause/blacklist; check whether error-handling cancels can revert, leaving orders live at stale prices.