# Swaps associated with position orders will use the wrong price

GMX swaps executed after position orders reused the order's custom (maximized/trigger) price instead of the market price, enabling arbitrage against the protocol.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2023-04-20
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-04-gmx-judging/issues/240
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** GMX Synthetics order/swap pricing (BaseOrderUtils, SwapUtils)
**Root cause:** getLatestPrice() returns the custom price (trigger/maximized) set during position-order execution, and SwapUtils._swap() reuses it for the subsequent token swap instead of the market price.
**Steps:**
1. Submit a market increase order; setExactOrderPrice sets custom price to the maximized price for execution.
2. Order executes and tokens are received at the maximized price.
3. The post-order swap in SwapUtils._swap() calls oracle.getLatestPrice() which still returns the custom maximized price.
4. Swap executes at the stale custom price rather than the market price, differing from a standalone swap order (which never sets an exact price).
5. Arbitrage the price discrepancy between the two swap paths.
**How found:** Code review comparing the previous getLatestPrice() logic (secondary price with primary fallback) to the new custom-price logic, noticing the custom price leaks into the post-order swap path while normal swap orders skip setExactOrderPrice.
**Exploitation:** Attacker places a position order whose execution sets a maximized custom price, then the associated swap of received tokens is priced at that custom price instead of market, letting them extract value via arbitrage versus a normal swap order.
**Insight:** When a pricing function gains a 'custom price' override, audit every downstream consumer that shares it — order execution and post-execution swaps should not share the same price source; check that swap-only paths bypass the override.