# Position fees are still assessed even if the ability to decrease positions is disabled

GMX keepers can disable order creation/execution, but time-based borrowing and funding fees keep accruing, so users can't close positions and may be liquidated unfairly.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/157
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-19
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** GMX Synthetics OrderHandler / MarketUtils fee accounting
**Root cause:** Feature-disable flags block order creation and execution, but borrowing/funding fees are computed purely from block.timestamp minus last-updated time, ignoring the paused window.
**Steps:**
1. Keeper sets createOrderFeatureDisabledKey / executeOrderFeatureDisabledKey for the relevant order type.
2. User attempts to close position via OrderHandler.createOrder -> reverts at FeatureUtils.validateFeature (line 43).
3. Existing orders also fail at _executeOrder (line 207).
4. Meanwhile getSecondsSinceCumulativeBorrowingFactorUpdated and getSecondsSinceFundingUpdated return block.timestamp - updatedAt, accruing fees during the disabled period.
5. User's position accrues fees and can be liquidated without being able to close.
**How found:** Code reading: noticed feature-disable checks in OrderHandler but that MarketUtils fee timers use raw block.timestamp deltas with no pause accounting, so disabled orders don't stop fee accrual.
**Insight:** When a protocol has emergency pause/disable flags, check every time-based accrual (funding, borrow, interest, rewards) for whether it honors the pause; mismatched pause coverage lets users be charged or liquidated during a freeze.