GMX, a decentralized exchange, awarded Collider Research a $1 million bug bounty in 2022. This payout was in recognition of their discovery of a critical bug in GMX’s smart contracts that directly affected how the protocol tracks outstanding debt.
The Bug Affecting GMX And GLP
GMX has not provided more information on how the bug was patched and when. However, the DEX operator said the bug negatively impacted GMX v1 liquidity providers (LPs) as the code led to inaccuracies in quotes related to “the fair value of tokens.” Specifically, the bug affected the Global Liquidity Pool (GLP), causing it to deviate from its fair value.
Since GMX supports up to 50X leverage, a system tracks debt borrowed by traders and how it is repaid. It is smart contract-driven, and the trader enters into debt for every leveraged position. If prices move against them, they are liquidated, and the margin securing the leveraged position is transferred to the protocol.
Any disruption to this mechanism can severely affect GMX, impacting revenue and disincentivizing liquidity providers from engaging.
In September 2022, a flaw affecting GLP and impacting the DEX’s “minimal fee” and “zero price impact” features saw an unidentified exploiter make way with over $570,000 from the AVAX/USD marketplace.
