# MAX\_PNL validation inconsistency

**URL:** <https://gov.gmx.io/t/max-pnl-validation-inconsistency/5063>\
**Category:** Site Feedback\
**Tags:** risk-reports\
**Created:** [March 19, 2026, 4:12am UTC](https://gov.gmx.io/t/max-pnl-validation-inconsistency/5063 "2026-03-19T04:12:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![typicalHuman](https://avatars.discourse-cdn.com/v4/letter/t/919ad9/32.png) [@typicalHuman](https://gov.gmx.io/u/typicalHuman)\
**Post date:** [March 19, 2026, 4:12am UTC](https://gov.gmx.io/t/max-pnl-validation-inconsistency/5063/1 "2026-03-19T04:12:34Z")

</div>

Hi everyone, I found a small issue: during the execution of a GLV deposit, the code compares the max PnL with `MAX_PNL_FACTOR_FOR_WITHDRAWALS` instead of `MAX_PNL_FACTOR_FOR_DEPOSITS` — [https://github.com/gmx-io/gmx-synthetics/blob/10cfbce6144ade8e9d5cd8c811573955bcd1c132/contracts/glv/glvDeposit/ExecuteGlvDepositUtils.sol#L188-L189](https://github.com/gmx-io/gmx-synthetics/blob/10cfbce6144ade8e9d5cd8c811573955bcd1c132/contracts/glv/glvDeposit/ExecuteGlvDepositUtils.sol#L188-L189)

Even though the correct key is used earlier - [https://github.com/gmx-io/gmx-synthetics/blob/10cfbce6144ade8e9d5cd8c811573955bcd1c132/contracts/glv/glvDeposit/ExecuteGlvDepositUtils.sol#L99](https://github.com/gmx-io/gmx-synthetics/blob/10cfbce6144ade8e9d5cd8c811573955bcd1c132/contracts/glv/glvDeposit/ExecuteGlvDepositUtils.sol#L99).

It’s a low-severity bug, and since it’s out of scope for your bug bounty program and doesn’t pose any major risk, I decided to just mention it here.

---

<div class="post-metadata">

**Author:** ![Saurabh](https://sea2.discourse-cdn.com/flex020/user_avatar/gov.gmx.io/saurabh/32/1237_2.png) [@Saurabh](https://gov.gmx.io/u/Saurabh)\
**Post date:** [March 19, 2026, 9:33am UTC](https://gov.gmx.io/t/max-pnl-validation-inconsistency/5063/2 "2026-03-19T09:33:53Z")

</div>

Appreciate for flagging this we have shared this with the dev team

---

<div class="post-metadata">

**Author:** ![Jonezee](https://sea2.discourse-cdn.com/flex020/user_avatar/gov.gmx.io/jonezee/32/1238_2.png) [@Jonezee](https://gov.gmx.io/u/Jonezee)\
**Post date:** [March 19, 2026, 12:15pm UTC](https://gov.gmx.io/t/max-pnl-validation-inconsistency/5063/3 "2026-03-19T12:15:00Z")

</div>

Thanks for bringing this up @typicalHuman.