The GMX protocol is historically the pioneer of native decentralized trading (Perp DEX) on the Arbitrum and Avalanche networks. The protocol's transition from a global liquidity pool (V1: GLP) to isolated markets (V2: GM Pools) required a complete overhaul of the smart-contract architecture and the integration of new anti-manipulation mechanisms.
To ensure the reliability of GMX V2, the code (the gmx-synthetics repository) underwent an unprecedented multi-layer review by leading audit firms and the white-hat community. Below is the official archive of audit opinions.
The audit architecture: Guardian Audits, Dedaub and Sherlock
Guardian Audits & Dedaub (V2 Synthetics audit)
The main auditors of V2 were the Guardian Audits and Dedaub teams. They carried out an extensive review of the two-step execution model (Keepers), the Auto-Deleveraging (ADL) mechanism and liquidity routing. Guardian's auditors spent 84 research weeks and uncovered/fixed more than 80 vulnerabilities before mainnet launch, confirming that the architecture isolates risks reliably.
Sherlock & Zellic (GMX-Solana adaptation)
With GMX launching on the Solana blockchain in late 2024, the Rust-based code required entirely new security approaches. The adapted logic underwent large-scale reviews and crowdsourced contests on the Sherlock platform, where dozens of independent specialists hunted for attack vectors specific to that environment.
Lessons from V1: ABDK & Quantstamp
The first version of the protocol (GLP) was initially reviewed by ABDK and Quantstamp. For a long time it was considered the gold standard; however, in July 2025 a complex logical vulnerability was discovered in the outdated V1 code (a $42M loss, successfully recovered by a white hat). This incident finally confirmed that GMX made the right call by moving to the isolated and more secure V2 architecture.
Risk management: isolation and MEV protection
The security of GMX V2 rests on two fundamental pillars that were thoroughly examined in every audit:
- Risk isolation (GM Pools): unlike V1, where the GLP token acted as a single pool, in V2 every market (for example, ETH/USD or DOGE/USD) has its own liquidity pool (GM token). If one asset suffers extreme volatility, it does not affect the liquidity of other pools. Read more about GMX tokenomics and ecosystem.
- Two-Step Execution & Data Streams: to protect against front-running (MEV), the user first submits a request transaction (Order). An automated Keeper then fetches the exact price via Chainlink Data Streams (pull model) and executes the trade. The audits confirmed that a trader cannot learn the execution price in advance, which makes sandwich attacks impossible.
Official security reports (GitHub Archives)
The table below lists the latest audit statuses for GMX. In the Web3 industry, the original reports are stored in the projects' public GitHub repositories — this guarantees permanent access to up-to-date PDF documents.
| Component / Protocol | Auditor | Vulnerability summary (TL;DR) | Document |
|---|---|---|---|
| GMX V2 Synthetics Core Execution & GM Pools |
Guardian Audits / Dedaub | Audit passed. Two-step execution logic and liquidity routing reviewed. More than 80 High/Critical vulnerabilities fixed before mainnet launch. | |
| GMX-Solana Cross-chain Expansion |
Sherlock / Zellic | Resolved. The adaptation of the logic to Rust/Solana passed a thorough review. Attack vectors specific to the platform and logical discrepancies were eliminated. | Report |
| GMX V1 Core (GLP) Legacy Contracts |
ABDK / Quantstamp | Deprecated (Exploited). Historical smart contracts. In July 2025 a $42M vulnerability was discovered (funds recovered). The focus has shifted to V2. | V1 PDF Archive |
| Bug Bounty & Oracles Immunefi / Chainlink |
Immunefi Platform | Active. The integrated math is protected by a community-driven bug bounty program, guaranteeing continued review of new attack vectors. | Immunefi GMX |
Education hub: How to read GMX V2 audits?
Interpreting audit reports for derivatives protocols differs from assessing simple DEXs. In GMX V2's case, the main focus is on the mechanisms protecting liquidity providers (LPs) from systemic insolvency.
Auto-Deleveraging (ADL)
Auditors scrutinize the ADL module. If traders' profits (PnL) start to exceed the pool's available liquidity (which could lead to insolvency), the smart contract automatically closes profitable positions to protect the capital of GM holders. It was essential to prove that the ADL mechanism cannot be triggered artificially by attackers.
Price Impact & Oracle Delays
The second most important threat is oracle delays. The Guardian and Dedaub reports confirm that GMX V2 enforces strict time windows for prices from Chainlink Data Streams. If a price is deemed "stale", the request transaction is rejected, making arbitrage on oracle delays (toxic flow) economically unviable.
Bug Bounty and active protection
Static audits are just the foundation. To ensure continuous security, the GMX DAO maintains one of the largest bug bounty programs in the industry on the Immunefi platform. Payouts to white hats can reach $5,000,000 for critical bugs that put user funds at risk. For on-chain monitoring of TVL and protocol activity, use public dashboards.
The GMX program on Immunefi