# Limit swap orders can be used to get a free look into the future

GMX LimitSwap orders execute on stale oracle block ranges, letting traders cancel after seeing future prices for a risk-free look-ahead.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: 0xdeadbeef
- Disclosed: 2023-04-20
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-04-gmx-judging/issues/241
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** GMX Synthetics SwapOrderUtils oracle block validation
**Root cause:** LimitSwap requires minOracleBlockNumbers strictly greater than orderUpdatedAtBlock, forcing execution at least two block ranges later, while MarketSwap can use the current block; staggered oracle block ranges let a trader observe the limit order's price before deciding to execute or cancel.
**Steps:**
1. Submit a large LimitSwap order at block N (oracles O1 and O2 both in range A).
2. Wait until block 6 where O1 is in N+2 and O2 still in N+1; limit order will price at median of block 5.
3. Observe O1's archived price for block 5 and predict O2's block 6 price.
4. If profit expected, submit opposite MarketSwap at block 6 (priced at block 6 median); if loss, cancel the LimitSwap paying only gas.
**How found:** Prior contest disclosed the same flaw for LimitDecrease/StopLossDecrease; researchers checked whether the fix covered LimitSwap and found SwapOrderUtils.validateOracleBlockNumbers still used a strict greater-than check for LimitSwap, then reasoned through staggered oracle block ranges to show the look-ahead.
**Exploitation:** Trader uses the two-block-range delay of LimitSwap plus staggered oracle ranges to know both the limit order's execution price and the market order's price before committing, canceling unprofitable limit orders for free and only executing profitable spreads at scale.
**Insight:** When a protocol fixes a bug class in some order types, audit every sibling order type for the same validation gap; here the incomplete fix left LimitSwap with a stricter block check than MarketSwap, creating a timing asymmetry exploitable via oracle block-range skew.