# Users' funds could be stolen or locked by malicious or rouge owners

Gfx LimitOrderRegistry owner can set a malicious fastGasFeed or call withdrawNative to inflate claim fees or drain ETH/WETH, stealing or locking user funds.

- Payout: Contest reward
- Severity: high
- Program: Gfx
- Credited: Dug
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-gfx-judging/issues/54
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-gfx%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:oracle-manipulation

**Target:** LimitOrderRegistry.sol (Uniswap V3 limit orders)
**Root cause:** Owner-controlled setFastGasFeed accepts an arbitrary feed whose getGasPrice() is used unvalidated in performUpkeep to compute estimatedFee; withdrawNative also forwards all native/WETH including user funds.
**Steps:**
1. Owner calls `setFastGasFeed(maliciousFeed)` where feed returns e.g. 100000 ETH gas price
2. Keeper calls `performUpkeep(performData)`; `getGasPrice()` returns huge value, `estimatedFee = upkeepGasLimit * getGasPrice()` becomes unaffordable
3. User cannot pay fee to claim fulfilled order, forfeiting swapped tokens
4. Alternatively owner calls `withdrawNative` to sweep all ETH/WETH including user-owed proceeds
**How found:** Started from README stating owner is restricted and must not steal funds; reviewed owner-only setters and fee computation path, spotting unvalidated external feed used in estimatedFee and withdrawNative sweeping all balances.
**Exploitation:** Malicious/rogue owner configures a malicious fastGasFeed reporting an extreme gas price so estimatedFee exceeds what users can pay, forcing forfeiture of swapped tokens; or directly calls withdrawNative to forward all native and wrapped ETH to themselves.
**Insight:** When a protocol declares the owner untrusted, audit every onlyOwner setter that injects an external data source (oracle/feed) into a value users must pay; check whether returned values are bounded by a constant like MAX_GAS_PRICE.