Submitted by KingNFT, also found by xiaoming90, ladboy233, 0x52, rvierdiiev, and HE1M
https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexGmx.sol#L615
https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexGmx.sol#L685
https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexGmx.sol#L712
The following redeem related functions are likely to be blocked, users will not be able to retrieve their funds.
The GlpManager contract of GMX has a cooldownDuration limit on redeem/unstake (\_removeLiquidity()). While there is at least one deposit/stake (\_addLiquidity()) operation in the past cooldownDuration time, redemption would fail. Obviously this limitation is user-based,  and PirexGmx contract is one such user.
https://github.com/gmx-io/gmx-contracts/blob/c3618b0d6fc1b88819393dc7e6c785e32e78c72b/contracts/core/GlpManager.sol#L234
https://arbiscan.io/address/0x321f653eed006ad1c29d174e17d96351bde22649#readContract
Due to the above limit, there are 3 risks that can block redemption for Pirex users.
Lets say there is 10% GMX users will use Pirex to manage their GLP.
By checking recent history of GMX router contract, we can find the average stake interval is smaller than 1 minute
https://arbiscan.io/address/0xa906f338cb21815cbc4bc87ace9e68c87ef8d8f1
Lets take
So if Pirex has 10% of GMX users, then
The probability of successfully redeeming is a typical Poisson distribution: https://en.wikipedia.org/wiki/Poisson_distribution.
With
So we get
Conclusion
A full list of % of GMX users versus failure probability of redemption
If an attacker, such as bad competitors of similar projects, try to exploit this vulnerability. 
Lets estimate the cost for attack.
An attacker can deposit a very small GLP, such as 1 wei, so we can ignore the GLP cost and only focus on GAS cost.
By checking the explorer history https://arbiscan.io
We are safe to assume the cost for calling 
depositGlpETH() or depositGlp is
To block redemption, attacker has to execute a deposit call every 15 minutes, so
Conclusion
If GMX increases cooldownDuration to 2 days, it will obviously cause redemption not working.
VS Code
Reserve some time range for redemption only. e.g. 1 of every 7 days.
kphed (Redacted Cartel) confirmed
