Submitted by rvierdiiev, also found by imare and 0x52
PirexGmx.initiateMigration can be blocked so contract will not be able to migrate his funds to another contract using gmx.
PirexGmx was designed with the thought that the current contract can be changed with another during migration.
PirexGmx.initiateMigration is the first point in this long process.
https://github.com/code-423n4/2022-11-redactedcartel/blob/main/src/PirexGmx.sol#L921-L935
As you can see gmxRewardRouterV2.signalTransfer(newContract); is called to start migration.
This is the code of signalTransfer function
https://arbiscan.io/address/0xA906F338CB21815cBc4Bc87ace9e68c87eF8d8F1#code#F1#L282
As you can see the main condition to start migration is that PirexGmx doesnt control any gmxVester and glpVester tokens.
So attacker can deposit and receive such tokens and then just transfer tokens directly to PirexGmx.
As a result migration will never be possible as there is no possibility for PirexGmx to burn those gmxVester and glpVester tokens.
Also in the same way, the migration receiver can also be blocked.
VS Code
Think about how to make contract ensure that he doesnt control any gmxVester and glpVester tokens before migration.
Picodes (judge) decreased severity to Medium
Please note: the following comment occurred after judging and awarding were finalized.
kphed (Redacted Cartel) commented:
