{"investigation":{"slug":"gmx-v1-perps","entity_name":"GMX V1 Perps","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"GMX V1 was a decentralized perpetual exchange on Arbitrum and Avalanche that operated from September 2021 until July 2025, when a reentrancy exploit drained approximately $42 million from its GLP liquidity pool. The protocol has since disabled all V1 trading and GLP minting; it is no longer an active product, with users directed to GMX V2, which was unaffected by the exploit.","sections":[{"content":"GMX V1 launched on Arbitrum on September 6, 2021, evolving from an earlier protocol called Gambit Financial that operated on BNB Smart Chain. The exchange expanded to Avalanche in January 2022. GMX V1 used a shared multi-asset liquidity pool model: traders opened leveraged perpetual positions (up to 50x) against the GLP pool, which was funded by liquidity providers who accepted the counterparty risk. The protocol priced assets using Chainlink oracle feeds rather than an on-chain AMM, allowing zero price-impact trades at the oracle price. At its peak in May 2023, GMX V1 held nearly $700 million in total value locked and processed over $305 billion in cumulative trading volume across approximately 714,000 users. In July 2025, following a critical exploit, GMX disabled V1 trading entirely on both Arbitrum and Avalanche. GLP can no longer be minted or redeemed. The V2 architecture, which uses isolated GM liquidity pools, is the only active GMX product as of mid-2025.","heading":"Background","sources":[{"url":"https://gmx-docs.io/docs/trading/v1/","name":"","type":"other","credibility":3},{"url":"https://medium.com/avalancheavax/gmx-deploys-to-avalanche-bringing-low-slippage-spot-and-perpetual-trading-to-defi-users-97f3c9140136","name":"","type":"other","credibility":3},{"url":"https://www.binance.com/en/square/post/4025612808434","name":"","type":"other","credibility":3},{"url":"https://cryptodaily.co.uk/2025/07/42m-stolen-in-gmx-v1-exploit-as-exchange-shuts-down-trading","name":"","type":"other","credibility":3},{"url":"https://docs.gmx.io/docs/providing-liquidity/v1/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"GMX V1 experienced two distinct security incidents during its operational life, plus a third incident in a third-party integration.\n\n**September 2022 — AVAX Price Manipulation ($565,000):** An attacker exploited GMX V1's zero-slippage oracle-pricing model on its AVAX/USD market. Because GMX fills trades at the Chainlink oracle price with no AMM slippage, an attacker could open large long and short positions on GMX and then move the AVAX price on centralized exchanges to manipulate the oracle feed in their favor. The attacker cycled between long and short positions approximately five times over the course of an hour, extracting an estimated $500,000–$700,000 from GLP liquidity providers. GMX's response was to cap open interest for AVAX long positions at $2 million and AVAX short positions at $1 million.\n\n**January 2024 — Abracadabra Cauldron Exploit ($13 million, indirect):** A $13 million exploit targeted Abracadabra.money's lending cauldrons, which used GMX V2 GM tokens as collateral. The vulnerability was in Abracadabra's liquidation logic, not GMX's contracts directly. GMX publicly confirmed its own contracts were not compromised. The attacker exploited a state inconsistency after a self-liquidation, borrowed against non-existent collateral, and laundered proceeds through Tornado Cash.\n\n**July 9, 2025 — Reentrancy Exploit ($42 million, critical):** The most severe incident was a reentrancy attack on the PositionManager.executeDecreaseOrder() function. The root cause was a 2022 bug fix that introduced an unaudited code path: when closing a position and sending profit to the recipient, the code transferred ETH to the caller before invoking timelock.disableLeverage(), creating a reentrancy window. The vulnerable assumption was that the _account parameter would always be an externally owned account (EOA); in practice, a malicious contract could be substituted. The attacker exploited a state desynchronization between GMX's Vault contract (which tracked globalShortSizes) and a separate ShortsTracker contract (which tracked globalShortAveragePrices). By reentering during the profit transfer, the attacker opened a massive BTC short directly via the Vault without the ShortsTracker updating. This artificially inflated the calculated AUM (assets under management), inflating GLP token prices. The attacker then redeemed GLP at the inflated price, draining approximately $42 million in ETH, WBTC, FRAX, and DAI. GMX immediately halted all V1 trading, GLP minting, and GLP redemption. The team offered a 10% white-hat bounty (~$4.2 million) with a 48-hour deadline for return of 90% of funds. The attacker eventually accepted, returned approximately $37 million, and retained a $5 million bounty. The Halborn security firm noted that the vulnerable 2022 fix was not audited before deployment, which explains why multiple prior audits failed to flag the flaw.","heading":"Security History","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-gmx-hack-july-2025","name":"","type":"other","credibility":3},{"url":"https://sherlock.xyz/post/gmx-exchange-hack-explained","name":"","type":"other","credibility":3},{"url":"https://slowmist.medium.com/inside-the-gmx-hack-42-million-vanishes-in-an-instant-6e42adbdead0","name":"","type":"other","credibility":3},{"url":"https://www.okx.com/en-us/learn/gmx-v1-exploit-defi-security-flaws","name":"","type":"other","credibility":3},{"url":"https://quillaudits.medium.com/how-gmx-v1-lost-42-million-to-a-reentrancy-attack-60711387c089","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/361806/hacker-drains-42-million-from-decentralized-perpetual-exchange-gmx","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/362164/gmx-token-surges-14-after-hacker-begins-returning-funds-from-40-million-exploit","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/decentralized-exchange-gmx-suffers-565k-price-manipulation-exploit","name":"","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/abracadabra-drained-13m-exploit-targeting-161442972.html","name":"","type":"other","credibility":3},{"url":"https://cryptopotato.com/gmx-defends-contracts-after-13-million-loss-tied-to-abracadabras-cauldron-exploit/","name":"","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/gmx-incident-analysis","name":"","type":"other","credibility":3},{"url":"https://blocksec.com/blog/gmx-incident-cross-contract-reentrancy-bypasses-a-four-year-old-guard","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"GMX V1 used Chainlink price feed oracles to price all assets in the GLP pool. Unlike AMM-based DEXs, GMX did not derive prices from on-chain liquidity depth; instead, it accepted trades at the prevailing Chainlink oracle price with zero price impact. This design provided a superior trading experience (no slippage, no sandwich attacks) but introduced a structural attack surface: a sophisticated actor who could move asset prices on liquid centralized venues could simultaneously profit by trading against GMX's fixed oracle price.\n\nThe September 2022 AVAX manipulation exploit illustrated this risk. Because GMX had no position-size limits or dynamic fees tied to open interest imbalance at that time, an attacker could open and flip large positions while moving the reference price on external markets. The protocol's mitigation — capping open interest per asset — partially addressed this risk but did not eliminate it for other assets.\n\nThe oracle design was also implicated in the July 2025 reentrancy exploit indirectly: the attacker manipulated GMX's internal accounting of short positions and AUM, which fed back into the GLP price calculation that the oracle mechanism ultimately served. GMX V2 replaced the shared GLP pool and its AUM-based pricing with isolated per-market GM pools, addressing both the oracle manipulation risk surface and the accounting desynchronization vulnerability.","heading":"Oracle Design","sources":[{"url":"https://cointelegraph.com/news/decentralized-exchange-gmx-suffers-565k-price-manipulation-exploit","name":"","type":"other","credibility":3},{"url":"https://medium.com/@thedailychris/technical-analysis-of-gmx-v1s-avax-usd-price-manipulation-exploit-21fbf762fa26","name":"","type":"other","credibility":3},{"url":"https://sherlock.xyz/post/gmx-exchange-hack-explained","name":"","type":"other","credibility":3},{"url":"https://gmx-docs.io/docs/trading/v1/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The GMX founding team is fully pseudonymous. The principal architect is known by the handle xdev_10 (also referenced as 'X'), who previously built Gambit Financial and XVIX on BNB Chain before migrating to Arbitrum. Additional pseudonymous contributors visible in the public GitHub repository include handles such as 0xBrooks and gkrasulya. No real-world identities for core team members have been publicly confirmed.\n\nThe protocol is governed via on-chain voting by GMX token holders, with major protocol changes (including keeper and timelock configurations) subject to a multisig. Community governance proposals are discussed on the GMX governance forum at gov.gmx.io. The GMX token has a fixed supply of 8.7 million and accrues 30% of protocol fees when staked.\n\nTeam anonymity is a commonly cited risk factor in DeFi protocols. In GMX's case, the team has maintained a years-long track record and delivered protocol updates in public view; however, the lack of any legally identifiable responsible parties means there is no accountability mechanism beyond multisig key control in the event of a dispute or regulatory action. The multisig signers have not all been publicly named.\n\nGMX has not disclosed external investors, venture capital backers, or any formal corporate entity. The protocol was bootstrapped and community-funded through token sales and fee revenue.","heading":"Team & Governance","sources":[{"url":"https://blog.mexc.com/wiki/who-is-gmx-founder/","name":"","type":"other","credibility":3},{"url":"https://x.com/xdev_10","name":"","type":"other","credibility":3},{"url":"https://gov.gmx.io/t/make-v2-the-most-audited-project-ever/4663","name":"","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/gmx/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"GMX V1 Perps is a deprecated protocol. As of July 2025, all trading has been halted and GLP minting and redemption have been permanently disabled by the team following the $42 million reentrancy exploit. Users who still hold GLP tokens should monitor official GMX communications regarding any recovery or migration pathway.\n\nKey risk factors that characterized GMX V1 during its operational life include:\n\n1. **Oracle manipulation exposure:** The zero-slippage, oracle-fed pricing model created a structural attack surface for actors who could move prices on external venues. This risk was partially mitigated by open-interest caps but was never fully eliminated in V1.\n\n2. **Unaudited code paths in production:** The July 2025 exploit exploited a 2022 bug fix that was deployed without a formal audit. ABDK Consulting audited the original Gambit/GMX contracts in April 2021, but subsequent incremental code changes — including the ShortsTracker integration — were not uniformly covered by independent audits before deployment. Halborn confirmed the specific vulnerable code path was introduced after the last formal review.\n\n3. **Cross-contract accounting desynchronization:** The Vault and ShortsTracker contracts maintained separate state for globalShortSizes and globalShortAveragePrices without atomic synchronization, creating a long-lived latent vulnerability.\n\n4. **Pseudonymous team with no legal entity:** There is no known corporate entity or legally identified individuals behind GMX. Accountability is limited to multisig key holders, whose identities have not all been publicly disclosed.\n\n5. **Protocol is now inactive:** As a deprecated product, GMX V1 carries no forward operational risk from trading, but residual risk exists for any GLP holders awaiting resolution, and any forks or clones of the V1 codebase should be considered critically vulnerable without substantial rearchitecting.\n\nThe protocol's prior auditing record was limited: a single pre-launch ABDK audit in April 2021 covered early Gambit logic, and no publicly disclosed comprehensive audit covered the full V1 codebase including keeper flows and the ShortsTracker integration. DeFiSafety rated GMX V1 at the time of its operation but flagged incomplete audit coverage. GMX V2 received substantially more audit investment, including engagements with multiple firms.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-gmx-hack-july-2025","name":"","type":"other","credibility":3},{"url":"https://github.com/gmx-io/gmx-contracts/blob/master/audits/ABDK_Audit_Review.txt","name":"","type":"other","credibility":3},{"url":"https://www.defisafety.com/app/pqrs/427","name":"","type":"other","credibility":3},{"url":"https://blocksec.com/blog/gmx-incident-cross-contract-reentrancy-bypasses-a-four-year-old-guard","name":"","type":"other","credibility":3},{"url":"https://getfailsafe.com/gmx-hack-42m-drained-what-we-know-so-far","name":"","type":"other","credibility":3},{"url":"https://coin360.com/news/gmx-v1-42m-exploit-fund-return-market-impact","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-04","event":"ABDK Consulting completes audit of early Gambit/GMX contracts prior to launch.","source":"","date_original":"2021-04-01"},{"date":"2021-09-06","event":"GMX V1 launches on Arbitrum, evolving from the Gambit Financial protocol on BNB Chain.","source":""},{"date":"2022","event":"GMX expands to Avalanche C-Chain, enabling GLP liquidity and perpetual trading on a second network.","source":"","date_original":"2022-01-01"},{"date":"2022-09-18","event":"Attacker exploits GMX V1's zero-slippage oracle pricing on the AVAX/USD market, extracting approximately $565,000 from GLP liquidity providers by manipulating external AVAX prices.","source":""},{"date":"2022-10","event":"GMX caps AVAX open interest (long: $2M, short: $1M) in response to the price manipulation exploit.","source":"","date_original":"2022-10-01"},{"date":"2022","event":"GMX awards a $1 million bug bounty to Collider research for discovering a critical vulnerability in the short position tracking system.","source":"","date_original":"2022-01-01"},{"date":"2023-05","event":"GMX V1 TVL peaks at approximately $700 million, representing roughly 15% of total Arbitrum TVL.","source":"","date_original":"2023-05-01"},{"date":"2024","event":"Abracadabra.money loses $13 million in an exploit targeting its lending cauldrons that used GMX V2 GM tokens as collateral. GMX's own contracts are not compromised.","source":"","date_original":"2024-01-01"},{"date":"2025-07-09","event":"Reentrancy exploit drains approximately $42 million from GMX V1's GLP pool on Arbitrum via a vulnerability in PositionManager.executeDecreaseOrder(). GMX immediately halts V1 trading and GLP minting/redemption on Arbitrum and Avalanche.","source":""},{"date":"2025-07-09","event":"GMX offers a 10% white-hat bounty (~$4.2 million) with a 48-hour deadline for return of 90% of stolen funds.","source":""},{"date":"2025-07-11","event":"Attacker sends an on-chain message accepting the bounty terms and begins returning funds. GMX token price rises approximately 14% on the news.","source":""},{"date":"2025-07","event":"Attacker returns approximately $37 million to the GMX multisig, retaining a $5 million bounty. GMX V1 remains permanently disabled.","source":"","date_original":"2025-07-01"}],"sources_used":[{"url":"https://gmx-docs.io/docs/trading/v1/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830001203/https://docs.gmx.io/docs/intro/","credibility":3,"archive_timestamp":"2026-08-30T00:12:03+00:00"},{"url":"https://medium.com/avalancheavax/gmx-deploys-to-avalanche-bringing-low-slippage-spot-and-perpetual-trading-to-defi-users-97f3c9140136","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"forbiddenaccess","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.binance.com/en/square/post/4025612808434","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830003424/https://www.binance.com/en/square/post/4025612808434","credibility":3,"archive_timestamp":"2026-08-30T00:34:24+00:00"},{"url":"https://cryptodaily.co.uk/2025/07/42m-stolen-in-gmx-v1-exploit-as-exchange-shuts-down-trading","name":"","type":"other","archive_url":"http://web.archive.org/web/20260109141830/https://cryptodaily.co.uk/2025/07/42m-stolen-in-gmx-v1-exploit-as-exchange-shuts-down-trading","credibility":3,"archive_timestamp":"2026-01-09T14:18:30+00:00"},{"url":"https://docs.gmx.io/docs/providing-liquidity/v1/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-gmx-hack-july-2025","name":"","type":"other","archive_url":"http://web.archive.org/web/20260414112737/https://www.halborn.com/blog/post/explained-the-gmx-hack-july-2025","credibility":3,"archive_timestamp":"2026-04-14T11:27:37+00:00"},{"url":"https://sherlock.xyz/post/gmx-exchange-hack-explained","name":"","type":"other","archive_url":"http://web.archive.org/web/20260608135425/https://sherlock.xyz/post/gmx-exchange-hack-explained","credibility":3,"archive_timestamp":"2026-06-08T13:54:25+00:00"},{"url":"https://slowmist.medium.com/inside-the-gmx-hack-42-million-vanishes-in-an-instant-6e42adbdead0","name":"","type":"other","archive_url":"http://web.archive.org/web/20251011090939/https://slowmist.medium.com/inside-the-gmx-hack-42-million-vanishes-in-an-instant-6e42adbdead0","credibility":3,"archive_timestamp":"2025-10-11T09:09:39+00:00"},{"url":"https://www.okx.com/en-us/learn/gmx-v1-exploit-defi-security-flaws","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829152646/https://www.okx.com/en-us/learn/gmx-v1-exploit-defi-security-flaws","credibility":3,"archive_timestamp":"2026-08-29T15:26:46+00:00"},{"url":"https://quillaudits.medium.com/how-gmx-v1-lost-42-million-to-a-reentrancy-attack-60711387c089","name":"","type":"other","archive_url":"http://web.archive.org/web/20250915003804/https://quillaudits.medium.com/how-gmx-v1-lost-42-million-to-a-reentrancy-attack-60711387c089","credibility":3,"archive_timestamp":"2025-09-15T00:38:04+00:00"},{"url":"https://www.theblock.co/post/361806/hacker-drains-42-million-from-decentralized-perpetual-exchange-gmx","name":"","type":"other","archive_url":"http://web.archive.org/web/20260616162043/https://www.theblock.co/post/361806/hacker-drains-42-million-from-decentralized-perpetual-exchange-gmx","credibility":3,"archive_timestamp":"2026-06-16T16:20:43+00:00"},{"url":"https://www.theblock.co/post/362164/gmx-token-surges-14-after-hacker-begins-returning-funds-from-40-million-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20260104095637/https://www.theblock.co/post/362164/gmx-token-surges-14-after-hacker-begins-returning-funds-from-40-million-exploit","credibility":3,"archive_timestamp":"2026-01-04T09:56:37+00:00"},{"url":"https://cointelegraph.com/news/decentralized-exchange-gmx-suffers-565k-price-manipulation-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20260729045524/https://cointelegraph.com/news/decentralized-exchange-gmx-suffers-565k-price-manipulation-exploit","credibility":3,"archive_timestamp":"2026-07-29T04:55:24+00:00"},{"url":"https://finance.yahoo.com/news/abracadabra-drained-13m-exploit-targeting-161442972.html","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cryptopotato.com/gmx-defends-contracts-after-13-million-loss-tied-to-abracadabras-cauldron-exploit/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830041733/https://cryptopotato.com/gmx-defends-contracts-after-13-million-loss-tied-to-abracadabras-cauldron-exploit/","credibility":3,"archive_timestamp":"2026-08-30T04:17:33+00:00"},{"url":"https://www.certik.com/resources/blog/gmx-incident-analysis","name":"","type":"other","archive_url":"http://web.archive.org/web/20251118020058/https://www.certik.com/resources/blog/gmx-incident-analysis","credibility":3,"archive_timestamp":"2025-11-18T02:00:58+00:00"},{"url":"https://blocksec.com/blog/gmx-incident-cross-contract-reentrancy-bypasses-a-four-year-old-guard","name":"","type":"other","archive_url":"http://web.archive.org/web/20260315200818/https://blocksec.com/blog/gmx-incident-cross-contract-reentrancy-bypasses-a-four-year-old-guard","credibility":3,"archive_timestamp":"2026-03-15T20:08:18+00:00"},{"url":"https://medium.com/@thedailychris/technical-analysis-of-gmx-v1s-avax-usd-price-manipulation-exploit-21fbf762fa26","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.mexc.com/wiki/who-is-gmx-founder/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://x.com/xdev_10","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://gov.gmx.io/t/make-v2-the-most-audited-project-ever/4663","name":"","type":"other","archive_url":"http://web.archive.org/web/20251107131316/https://gov.gmx.io/t/make-v2-the-most-audited-project-ever/4663","credibility":3,"archive_timestamp":"2025-11-07T13:13:16+00:00"},{"url":"https://coinmarketcap.com/currencies/gmx/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260129161118/https://coinmarketcap.com/currencies/gmx/","credibility":3,"archive_timestamp":"2026-01-29T16:11:18+00:00"},{"url":"https://github.com/gmx-io/gmx-contracts/blob/master/audits/ABDK_Audit_Review.txt","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829134201/https://github.com/gmx-io/gmx-contracts/blob/master/audits/ABDK_Audit_Review.txt","credibility":3,"archive_timestamp":"2026-08-29T13:42:01+00:00"},{"url":"https://www.defisafety.com/app/pqrs/427","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830050021/https://www.defisafety.com/app/pqrs/427","credibility":3,"archive_timestamp":"2026-08-30T05:00:21+00:00"},{"url":"https://getfailsafe.com/gmx-hack-42m-drained-what-we-know-so-far","name":"","type":"other","archive_url":"http://web.archive.org/web/20260212012740/https://getfailsafe.com/gmx-hack-42m-drained-what-we-know-so-far","credibility":3,"archive_timestamp":"2026-02-12T01:27:40+00:00"},{"url":"https://coin360.com/news/gmx-v1-42m-exploit-fund-return-market-impact","name":"","type":"other","archive_url":"http://web.archive.org/web/20260309090157/https://coin360.com/news/gmx-v1-42m-exploit-fund-return-market-impact","credibility":3,"archive_timestamp":"2026-03-09T09:01:57+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:47.990121+00:00","updated_at":"2026-08-30T05:14:12.640822+00:00"}}