# Malicious order keepers can trigger the cancellation of any order, with old blocks

Malicious GMX order keepers can pass oracle prices from wrong blocks, causing valid orders to be cancelled instead of retried, risking liquidations.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/163
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-15
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:oracle-manipulation

**Target:** GMX Synthetics order execution / oracle price validation
**Root cause:** Order error handlers only allow retry when keeper supplies empty/invalid prices, but not when oracle block numbers are out of range or mismatched, so those reverts cause order cancellation.
**Steps:**
1. Keeper executes an order via OrderHandler/WithdrawalHandler/DepositHandler supplying oracleBlockNumbers from an unrelated/old block.
2. OracleUtils reverts with OracleBlockNumbersAreNotEqual / SmallerThanRequired / NotWithinRange.
3. Error handler does not catch these reverts, so the order is cancelled rather than retried.
**How found:** Code review of order error handlers versus OracleUtils revert paths; noticed block-range reverts are not in the retry allowlist while price reverts are.
**Exploitation:** A malicious keeper deliberately submits stale or mismatched oracle block numbers when executing a victim's order, forcing the block-range revert that the error handler treats as a cancellation, denying execution and potentially triggering liquidation.
**Insight:** When auditing keeper/executor systems, compare the set of revert reasons treated as retryable against all revert paths in validation code; any uncaught revert becomes a griefing/cancellation primitive.