# Orders with single-sided deposits that are auto-adjusted, always revert

Inverted comparison in GMX ExecuteDepositUtils.getAdjustedLongAndShortTokenAmounts causes uint256 underflow, making auto-adjusted single-sided deposits always revert.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/165
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** GMX Synthetics deposit execution (ExecuteDepositUtils)
**Root cause:** The branch condition `poolLongTokenAmount < poolShortTokenAmount` is inverted relative to the subtraction performed, so `poolLongTokenAmount - poolShortTokenAmount` underflows on uint256 when the long amount is smaller; the else branch has the same inversion.
**Steps:**
1. Call deposit with only the long collateral token such that the order is auto-adjusted to minimize price impact
2. Reach ExecuteDepositUtils.getAdjustedLongAndShortTokenAmounts with poolLongTokenAmount < poolShortTokenAmount
3. Observe `uint256 diff = poolLongTokenAmount - poolShortTokenAmount` underflow and revert
4. Fix: change condition to `poolLongTokenAmount > poolShortTokenAmount`
**How found:** Manual code review of the adjustment logic; noticed the comparison direction contradicts the subtraction operands, causing underflow.
**Insight:** When a function picks which of two values to subtract based on a comparison, verify the comparison direction matches the subtraction operands — inverted branches on unsigned ints silently become guaranteed reverts.