GMX DEX Suffers $565,000 Exploit on Avalanche (AVAX)

Decentralized exchange GMX allegedly fell victim to a price manipulation exploit worth around $565,000 on the AVAX/USD pair.

GMX Suffers $565K Price Manipulation Exploit

GMX, a decentralized exchange, was reportedly subjected to a price manipulation exploit by an exploiter who managed to siphon off $565,000 from the AVAX/USD market.

The exploiter is believed to have taken advantage of GMX’s “minimal spread” and “zero price impact” features to carry out the exploit, which affected GLP token holders who provided liquidity in the form of AVAX (the Avalanche token) to GMX.

In a tweet on September 18, GMX confirmed the price manipulation exploit but indicated that the AVAX/USD market would remain open while setting a $2 million cap on long positions and a $1 million cap on short positions.

Joshua Lim, head of Derivatives at Genesis Trading, was among the first to assess the vulnerability, noting that the exploiter “successfully extracted profits from GMX’s AVAX/USD market by opening large positions at 0 slippage” before moving the AVAX/USD to centralized exchanges at a little higher price.

Lim stated that this exploit method was executed five times, with the first cycle beginning at 01:15 UTC on September 18. Each cycle moved over 200,000 AVAX tokens (about $4-5 million per cycle), with the exploiter making around $565,000 after paying spread to market makers on other exchanges.

However, Lim stated that this was not an “exploit” because GMX was operating as intended.

GMX Warned on Price Manipulation Concerns

On September 3, 2022, @derpaderpederp, a Twitter user and the founder of Zig-Zag, stated that anyone with extensive knowledge of GMX might manipulate the price of ETH, or in this case, AVAX, as trading has no bearing on GMX’s price. According to the DEX website, “Enter and exit positions with minimal spread and zero price impact.” A spread is a difference between the buy and sell prices of an asset.

They may take a long position on GMX by purchasing $50 million in AVAX. They may then purchase $40 million worth of AVAX at a premium on a centralized exchange such as Binance or Coinbase. After closing the long position on GMX and making a profit, the trader might establish a $20 million short position in AVAX and sell $40 million of AVAX back to the centralized exchanges at a discount, pocketing an additional profit.

This process can be performed several times, thereby draining the liquidity of GLP, the liquidity provider token, on the GMX. GLP owns an index of assets utilized in the platform’s leveraged trading. It can be minted with any index asset and then burned to redeem an index asset.

Community Reaction

The news elicited a range of reactions from the GMX community. One Twitter user emphasized that no smart contract was exploited, while another asked GMX if any compensation would be issued to impacted GLP holders.

On GMX, liquidity providers offer BTC, ETH, AVAX, and stablecoins for GLP tokens. The protocol was deployed in late 2021 on Ethereum layer-2 scaling network Arbitrum.

The GMX token (GMX) is currently trading at $39.38, an 11.2% drop over the last 24 hours, according to data from CoinMarketCap.