CVE-2026-45130

A flaw was found in Vim, an open-source command-line text editor. A heap buffer overflow exists in the readcompound function when processing a specially crafted spell file .spl with UTF-8 encoding active. A remote attacker could exploit this by convincing a user to open a text file containing a...

Functions like AutoPxGmx.withdraw and AutoPxGmx.redeem do not provide effective slippage control

Lines of code Vulnerability details Impact As shown below, calling the AutoPxGmx.withdraw and AutoPxGmx.redeem functions would execute compoundpoolFee, 1, 0, true, which uses the hardcoded 1 as the amountOutMinimum input of the AutoPxGmx.compound function to further call the...

A malicious user might call AutoPxGmx.compound() with a higher fee than poolFee.

Lines of code Vulnerability details Impact A malicious user might call AutoPxGmx.compound with a higher fee than poolFee. As a result, there would be a fund loss for the users because they paid more than expected for the swap router. Proof of Concept As we can see here, Uniswap V3 introduces...

The compound() function is used with a fixed amountOutMinimum value

Lines of code Vulnerability details Impact The compound function helps to swap the gmxBaseReward ether for GMX tokens then the GMX tokens are deposited for pxGMX. In the swap function the amountOutMinimum helps to put the minimum value that is expected for the swap. The fixed amountOutMInimum...