Sell-side redemption pays ~60% of face on BSC Gambit Vault, read-only findings, no exploit

Uncategorized
1

Hi all! sharing some read-only findings from reviewing the old BSC Gambit Vault (0xc73A8DcAc88498FD4b4B1b2AaA37b0a2614Ff67B). Everything below was done on a local mainnet fork. No mainnet transactions, no funds touched.
The observation
Roundtrip through the vault loses ~40%:

  1. buyUSDG(WBNB) with 1 WBNB → 762.5 USDG, correct, ($768.6 oracle − 0.8% fee)
  2. sellUSDG(WBNB) with those 762.5 USDG → 0.5945 WBNB, wrong, (expected ~0.985)
  3. getRedemptionAmount() static call agrees (~0.585), so it’s deterministic in-contract pricing, not MEV or a bad block.
    Where I’d look
    The sell path : sellUSDG() → getRedemptionAmount() / getRedemptionCollateral*() accounting. In stock GMX v1 this pays ~face; here it pays ~59% of face. Prime suspects, in order:
  4. Redemption capped by available-collateral math while OI/reserves are high
  5. Stale guaranteedUsd / reservedAmounts never corrected after liquidations
  6. Fee stacking on the sell path beyond the quoted 0.8%
    Also worth a glance: redemptionBasisPoints(WBNB) reads 165399 : please confirm units/intent.
    What I ruled out (all tested, all clean)

  • Gov/price/fee/router setters: all revert for non-gov

  • Direct position/liquidation calls without router path: revert

  • Donation-inflated minting: pool accounting grew exactly by deposits

  • minPrice == maxPrice (secondary feed agrees to the wei), minProfit 150 bps

  • addRouter is permissionless (anyone can register) : but routers are inert until individual accounts approve them, so phishing surface only, not a drain.
    Severity: Low. Deterministic, no theft path, affects sellers on sunset code. Flagging it so it’s on record, not claiming a critical.

    Forge traces available on request. If the team finds this useful, tips welcome (ARB/USDC): 0x71dEeD10d6278f937db53b9f0a60dC91d29F79A7