# Keeper can make deposits/orders/withdrawals fail and receive fee+rewards

Malicious GMX keeper supplies just enough gas so _executeDeposit reverts on OOG but the catch handler succeeds, cancelling deposits and collecting execution fee plus rewards.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: 0xdeadbeef
- Disclosed: 2022-09-22
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/116
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-31
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** GMX Synthetics DepositHandler/OrderHandler execute functions
**Root cause:** executeDeposit wraps _executeDeposit in try/catch; the 63/64 gas forwarding rule lets a keeper supply gas such that the inner call OOGs while the catch path (cancellation + fee payout) still has 1/64 to complete.
**Steps:**
1. Grant ORDER_KEEPER role to attacker contract.
2. Create a deposit with callbackGasLimit near max (2,000,000) and a callback that consumes ~1.99M gas.
3. Call `depositHandler.executeDeposit{gas: 6_900_000}(depositKey, oracleParams)` from the keeper.
4. Inner _executeDeposit runs out of gas (63/64 consumed), reverting into catch.
5. catch calls _handleDepositError which cancels the deposit and pays execution fee + rewards to keeper.
**How found:** Researcher read the try/catch in DepositHandler.executeDeposit and reasoned about the EVM 63/64 gas forwarding rule: if the inner call OOGs, the catch still has 1/64 to run, so a keeper controlling gas can force cancellation while still being paid.
**Exploitation:** Keeper submits executeDeposit with a gas amount tuned so 63/64 is insufficient for the try body but 1/64 suffices for the catch. The deposit is cancelled, funds returned minus execution fee, and keeper keeps fee plus incentive rewards. Repeated across all deposits/orders/withdrawals drains execution fees and can cancel user actions.
**Escalation:** Keeper can also self-create deposits and cancel them to farm rewards, draining vaults.
**Insight:** Any try/catch around an external self-call where the catch path pays the caller is griefable: the caller controls gas, and 63/64 forwarding means the try can OOG while catch succeeds. Check callbackGasLimit and gas accounting in keeper/executor patterns.