# MarketUtils.getPoolValueInfo() does not use !maximize when evaluating impactPoolUsd, leading to wrong logic of maximizing or minimizing the pool value.

GMX MarketUtils.getPoolValueInfo used maximize instead of !maximize for impactPoolUsd, overestimating withdrawal output amounts and risking pool drain.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: chaduke
- Disclosed: 2023-04-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-gmx-judging/issues/160
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** GMX Synthetics MarketUtils.getPoolValueInfo pool valuation
**Root cause:** impactPoolUsd is subtracted from total pool USD value but was computed with indexTokenPrice.pickPrice(maximize) instead of pickPrice(!maximize), inverting the min/max intent for that term.
**Steps:**
1. Trace withdrawal flow: WithdrawalUtils.executeWithdrawal -> _executeWithdrawal -> _getOutputAmounts -> MarketUtils.getPoolValueInfo with maximize=false
2. In getPoolValueInfo, note longTokenUsd/shortTokenUsd use pickPrice(maximize) and PnL uses pickPrice(!maximize)
3. Observe impactPoolUsd uses indexTokenPrice.pickPrice(maximize) though it is subtracted
4. Result: pool value not truly minimized on withdrawal, output amounts slightly overestimated
5. Fix: use indexTokenPrice.pickPrice(!maximize) for impactPoolUsd
**How found:** Code review of getPoolValueInfo, comparing which terms use maximize vs !maximize and noticing impactPoolUsd (a subtracted term) used the wrong direction unlike PnL.
**Exploitation:** Repeated withdrawal orders exploit the overestimated output amounts to extract slightly more long/short tokens than intended, accumulating pool drain over time.
**Insight:** In min/max valuation functions, audit every subtracted term: terms that reduce the total must use the opposite price direction from terms that add, or the extremum guarantee silently breaks.