GMX Releases $40 Million Vulnerability Exploitation Event Recap: Further Discussion on Compensation Measures

On July 11th, GMX officially released a summary report regarding the approximately $40 million exploit on Arbitrum in GMX V1. Event Summary: The attacker managed to bypass the PositionRouter and PositionManager contracts (which are typically responsible for calculating the average short price) by directly invoking the increasePosition function of the Vault contract through reentrancy. By means of manipulation, the attacker reduced the BTC average short price from $109,505.77 to $1,913.70. Using a flash loan, the attacker purchased GLP at a normal price of $1.45 and opened a $15 million position. Due to the manipulated price, the GLP price was pushed above $27, enabling the attacker to redeem GLP at a high price for profit. GMX has confirmed that V2 does not have a similar vulnerability. Next Step Funding Situation: Approximately $3.6 million remains in the GLP pool, reserved for unclosed positions. The cost of V1's GLP on Arbitrum this week is approximately $500,000 (excluding the 30% portion allocated to GMX stakers) and will be transferred to the DAO Treasury for compensation. GLP minting and redemption on Arbitrum will be disabled (the redemption disablement requires a 24-hour Timelock). GLP minting on Avalanche will be disabled while the redemption function will be retained. The closure of V1 positions on Arbitrum and Avalanche will be enabled, and the opening of positions will be disabled to prevent a recurrence of the vulnerability. V1 orders on Arbitrum and Avalanche will be cancelled. The remaining funds in the GLP pool on Arbitrum will be allocated to the compensation pool for the use of affected GLP holders. After the above steps are completed, the GMX DAO will discuss further compensation measures. It is recommended that all GMX V1 forks take immediate action and await fixes and audits before re-enabling the trading and minting of GLP-like tokens.