# User can loose funds in case if swapping in DecreaseOrderUtils.processOrder will fail

GMX decrease orders apply swap-path slippage to the no-swap fallback, so a failed swap lets users receive less than intended.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: rvierdiiev
- Disclosed: 2023-04-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-gmx-judging/issues/50
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** DecreaseOrderUtils.processOrder swap fallback in gmx-synthetics
**Root cause:** When the swap reverts, _handleSwapError validates result.outputAmount against order.minOutputAmount, which was set assuming swap fees would be deducted; without the swap the user should receive the full amount but is instead checked against a lower slippage floor.
**Steps:**
1. User submits decrease order with a swap path and minOutputAmount set to ~97% of result.outputAmount to account for swap fees.
2. Keeper executes order; swapHandler.swap reverts (e.g. missing asset price).
3. catch branch calls _handleSwapError, which calls _validateOutputAmount(oracle, result.outputToken, result.outputAmount, order.minOutputAmount()).
4. Since minOutputAmount is 97% of result.outputAmount, validation passes and transferOut sends result.outputAmount, but the user's intended no-swap expectation (100%) is not enforced, allowing frontrun/keeper to capture the 3% delta.
**How found:** Code reading of DecreaseOrderUtils.processOrder: noticed _validateOutputAmount is called with result.outputAmount in the catch path but with swapOutputAmount in the success path, and reasoned the minOutputAmount was calibrated for the swap case, not the no-swap case.
**Exploitation:** Keeper or frontrunner causes the swap to revert (e.g. by withholding an asset price so swap reverts) and captures the slippage difference between the swap-adjusted minOutputAmount and the full result.outputAmount.
**Insight:** When a contract has a success path and a fallback/catch path that both validate against the same user-supplied slippage parameter, check whether that parameter was calibrated for the success path's fee structure; the fallback may silently accept a worse-than-intended amount.