Audit log

Every state-changing event for GMX V1 Perps: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 21:18:05Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,849,019

   sig

   5HMG9RbYLgw7…MVToyRNBcopyexplorer ↗

   hash

   GibJBP9qmtEV…VtKovHfWcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6984 B) ▸

   {"actor":"system:backfill","investigation_id":"8429673a-c5b0-46af-a885-ca3107e51347","kind":"publish","page_slug":"gmx-v1-perps","published_at":"2026-05-19T21:18:05.535Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"GMX V1 Perps","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://gmx-docs.io/docs/trading/v1/"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/avalancheavax/gmx-deploys-to-avalanche-bringing-low-slippage-spot-and-perpetual-trading-to-defi-users-97f3c9140136"},{"credibility":3,"name":"","type":"other","url":"https://www.binance.com/en/square/post/4025612808434"},{"credibility":3,"name":"","type":"other","url":"https://cryptodaily.co.uk/2025/07/42m-stolen-in-gmx-v1-exploit-as-exchange-shuts-down-trading"},{"credibility":3,"name":"","type":"other","url":"https://docs.gmx.io/docs/providing-liquidity/v1/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-gmx-hack-july-2025"},{"credibility":3,"name":"","type":"other","url":"https://sherlock.xyz/post/gmx-exchange-hack-explained"},{"credibility":3,"name":"","type":"other","url":"https://slowmist.medium.com/inside-the-gmx-hack-42-million-vanishes-in-an-instant-6e42adbdead0"},{"credibility":3,"name":"","type":"other","url":"https://www.okx.com/en-us/learn/gmx-v1-exploit-defi-security-flaws"},{"credibility":3,"name":"","type":"other","url":"https://quillaudits.medium.com/how-gmx-v1-lost-42-million-to-a-reentrancy-attack-60711387c089"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/361806/hacker-drains-42-million-from-decentralized-perpetual-exchange-gmx"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/362164/gmx-token-surges-14-after-hacker-begins-returning-funds-from-40-million-exploit"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/decentralized-exchange-gmx-suffers-565k-price-manipulation-exploit"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/abracadabra-drained-13m-exploit-targeting-161442972.html"},{"credibility":3,"name":"","type":"other","url":"https://cryptopotato.com/gmx-defends-contracts-after-13-million-loss-tied-to-abracadabras-cauldron-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/gmx-incident-analysis"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/gmx-incident-cross-contract-reentrancy-bypasses-a-four-year-old-guard"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/decentralized-exchange-gmx-suffers-565k-price-manipulation-exploit"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/@thedailychris/technical-analysis-of-gmx-v1s-avax-usd-price-manipulation-exploit-21fbf762fa26"},{"credibility":3,"name":"","type":"other","url":"https://sherlock.xyz/post/gmx-exchange-hack-explained"},{"credibility":3,"name":"","type":"other","url":"https://gmx-docs.io/docs/trading/v1/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.mexc.com/wiki/who-is-gmx-founder/"},{"credibility":3,"name":"","type":"other","url":"https://x.com/xdev_10"},{"credibility":3,"name":"","type":"other","url":"https://gov.gmx.io/t/make-v2-the-most-audited-project-ever/4663"},{"credibility":3,"name":"","type":"other","url":"https://coinmarketcap.com/currencies/gmx/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-gmx-hack-july-2025"},{"credibility":3,"name":"","type":"other","url":"https://github.com/gmx-io/gmx-contracts/blob/master/audits/ABDK_Audit_Review.txt"},{"credibility":3,"name":"","type":"other","url":"https://www.defisafety.com/app/pqrs/427"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/gmx-incident-cross-contract-reentrancy-bypasses-a-four-year-old-guard"},{"credibility":3,"name":"","type":"other","url":"https://getfailsafe.com/gmx-hack-42m-drained-what-we-know-so-far"},{"credibility":3,"name":"","type":"other","url":"https://coin360.com/news/gmx-v1-42m-exploit-fund-return-market-impact"}]}],"sources_used":[],"summary":"GMX V1 was a decentralized perpetual exchange on Arbitrum and Avalanche that operated from September 2021 until July 2025, when a reentrancy exploit drained approximately $42 million from its GLP liquidity pool. The protocol has since disabled all V1 trading and GLP minting; it is no longer an active product, with users directed to GMX V2, which was unaffected by the exploit.","timeline":[{"date":"2021-04-01","event":"ABDK Consulting completes audit of early Gambit/GMX contracts prior to launch.","source":""},{"date":"2021-09-06","event":"GMX V1 launches on Arbitrum, evolving from the Gambit Financial protocol on BNB Chain.","source":""},{"date":"2022-01-01","event":"GMX expands to Avalanche C-Chain, enabling GLP liquidity and perpetual trading on a second network.","source":""},{"date":"2022-09-18","event":"Attacker exploits GMX V1's zero-slippage oracle pricing on the AVAX/USD market, extracting approximately $565,000 from GLP liquidity providers by manipulating external AVAX prices.","source":""},{"date":"2022-10-01","event":"GMX caps AVAX open interest (long: $2M, short: $1M) in response to the price manipulation exploit.","source":""},{"date":"2022-01-01","event":"GMX awards a $1 million bug bounty to Collider research for discovering a critical vulnerability in the short position tracking system.","source":""},{"date":"2023-05-01","event":"GMX V1 TVL peaks at approximately $700 million, representing roughly 15% of total Arbitrum TVL.","source":""},{"date":"2024-01-01","event":"Abracadabra.money loses $13 million in an exploit targeting its lending cauldrons that used GMX V2 GM tokens as collateral. GMX's own contracts are not compromised.","source":""},{"date":"2025-07-09","event":"Reentrancy exploit drains approximately $42 million from GMX V1's GLP pool on Arbitrum via a vulnerability in PositionManager.executeDecreaseOrder(). GMX immediately halts V1 trading and GLP minting/redemption on Arbitrum and Avalanche.","source":""},{"date":"2025-07-09","event":"GMX offers a 10% white-hat bounty (~$4.2 million) with a 48-hour deadline for return of 90% of stolen funds.","source":""},{"date":"2025-07-11","event":"Attacker sends an on-chain message accepting the bounty terms and begins returning funds. GMX token price rises approximately 14% on the news.","source":""},{"date":"2025-07-01","event":"Attacker returns approximately $37 million to the GMX multisig, retaining a $5 million bounty. GMX V1 remains permanently disabled.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fdad7108-4d5a-4313-8fa0-485cc7392ec2copy
2. #2rescoreby systemsystem

   2026-10-27 06:07:15Z
   Score: 28 → 50 (+22)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 50. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit well known and widely used +15, long-running +8; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,456

   sig

   3BxeGtixkbPV…zZxdrEG2copyexplorer ↗

   hash

   Cjkmntew1KVn…EXMvUFt9copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (713 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:15.912Z","decision":"rescore","investigation_id":"8429673a-c5b0-46af-a885-ca3107e51347","new_score":50,"page_slug":"gmx-v1-perps","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 50. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit well known and widely used +15, long-running +8; no longer operating, so capped at 50.","score_delta":22,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a23fe429-5d7d-4f76-8ee3-2be6e5a6e316copy
3. #3reviewby reviewerreviewer

   2026-10-27 19:22:04Z
   Score: 50 → 50 (no score change)
   The core narrative holds up: the July 2025 reentrancy exploit of about $42M, the partial return, the September 2022 AVAX manipulation, and V1's shutdown are all supported by the sources I checked. Weaknesses are an unreconciled bounty figure ($4.2M versus the $5M retained), an unsupported inference attributed to Halborn, an unsourced Collider timeline entry, and an out-of-date instruction to GLP holders that omits the August 2025 GLV compensation plan. Team, governance and audit-history sections were not checked in depth.
   anchoranchored

   chain

   ●mainnet-betaslot 462,187,388

   sig

   3CegxZ239H86…NzdJaF3ecopyexplorer ↗

   hash

   uPNebFPHacAs…4ojjsd1tcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1379 B) ▸

   {"actor":"reviewer","artifact_identity":"60392b4c16ad3a37500ed48835564737","decided_at":"2026-10-27T19:22:04.339Z","decision":"review","disputed_pct":0.0909,"findings_hash":"Bs8m2L6XBGA4v4fa1v8nkUDQAKoFbnexa8g5Dm2Nm6BR","investigation_id":"8429673a-c5b0-46af-a885-ca3107e51347","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":1,"total":1},"page_content_hash":"59b930e696c42c4ccd84b04555788fb4a46790400139f84fb1e6fe96184eb904","page_slug":"gmx-v1-perps","prev_score":50,"reason":"The core narrative holds up: the July 2025 reentrancy exploit of about $42M, the partial return, the September 2022 AVAX manipulation, and V1's shutdown are all supported by the sources I checked. Weaknesses are an unreconciled bounty figure ($4.2M versus the $5M retained), an unsupported inference attributed to Halborn, an unsourced Collider timeline entry, and an out-of-date instruction to GLP holders that omits the August 2025 GLV compensation plan. Team, governance and audit-history sections were not checked in depth.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ece035cd-7f3e-4ba5-96f0-a18939fe094ecopy
4. #4review reviseby judgejudge

   2026-10-27 19:22:04Z
   Score: 50 → 50 (no score change)
   The core account holds up. The July 2025 reentrancy exploit of about $42M, the partial return of funds, the September 2022 AVAX manipulation and V1's shutdown are confirmed (claim_findings[0], [3], [4]). Claim-level disputes are low, but the page omits the August 2025 compensation plan for affected GLP holders and still tells them to watch for a recovery pathway (claim_findings[10], omission_findings[0]). The page also leaves the ~$4.2M bounty unreconciled with the $5M retained (claim_findings[1], [2]) and presents an inference about prior audits as Halborn's statement (claim_findings[5]). These are correctable and do not undermine the main account, so a minor revision is appropriate.
   anchoranchored

   chain

   ●mainnet-betaslot 462,187,393

   sig

   PiEs4gvxcTLq…ZHuedjb4copyexplorer ↗

   hash

   7pJCSfhZwJXy…h16eUPH4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2006 B) ▸

   {"actor":"judge","artifact_identity":"60392b4c16ad3a37500ed48835564737","band_override":null,"decided_at":"2026-10-27T19:22:04.339Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.0909,"investigation_id":"8429673a-c5b0-46af-a885-ca3107e51347","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"gmx-v1-perps","prev_score":50,"reason":"The core account holds up. The July 2025 reentrancy exploit of about $42M, the partial return of funds, the September 2022 AVAX manipulation and V1's shutdown are confirmed (claim_findings[0], [3], [4]). Claim-level disputes are low, but the page omits the August 2025 compensation plan for affected GLP holders and still tells them to watch for a recovery pathway (claim_findings[10], omission_findings[0]). The page also leaves the ~$4.2M bounty unreconciled with the $5M retained (claim_findings[1], [2]) and presents an inference about prior audits as Halborn's statement (claim_findings[5]). These are correctable and do not undermine the main account, so a minor revision is appropriate.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"severity_override":{"applied":true,"band":"minor","from_band":"approve","reason":"Counting claim_findings directly, 1 of 11 is unverifiable (not_found) and none is disputed, giving about 9%, which falls in the approve band. The review also reports a material omission: the August 2025 GMX compensation plan (about $44M in GLV tokens) is missing, and claim_findings[10] is stale because the page tells GLP holders to wait for a recovery pathway that was already announced. Escalated one band to minor. The subject is not newly shut down or contradicted (contradicts_page is false), and the omission rests on a single Tier 3 source, so significant is not warranted."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 1b53891b-5667-4473-8d0c-2c8d81202ff0copy