GMX (GMX)

GMX is a popular decentralized derivatives exchange on Arbitrum and Avalanche (as of 8-2022) that specializes in perpetual contracts.

Basics

• Based in:
• Started in / Announced on:
• Testnet release:
• Mainnet release:

Audits & Exploits

• Bug bounty program can be found here and goes up to $5M (22-8-2022).
• Scored 85% on DeFi Safety (22-4-2022):

GMX links every core smart contract to their respective source code locations in their GitHub. Although GMX does not have a public code coverage report, they certainly have a very in-depth testing suite. There is no visible test result report in any of GMX's documentation or GitHub repositories. GMX has not undergone a Formal Verification test. GMX has been audited once pre-launch by ABDK Consulting. Any major issues found were resolved by the GMX team, as mentioned here.

• The GMX contracts have been audited by ABDK Consulting (10-2021).

Bugs/Exploits

• A MEV sandwitch bot is targeting GMX unstakers who try to sell their GMX (4-10-2022):

"I plotted users' selling habits after unstaking, and for example, found out that for a user with burned APY higher than 60%, there’s a >70% chance of selling the coins within 5 minutes of unstaking. Using this information one could build a probabilistic sandwich bot.. except I found there already is one! This MeV strategy sandwiches high volume unstaking actions, selling right after they unstake and buying back after they sell. Using this strategy they’ve generated 55 GMX (2270$) in 45 days. This strategy is probabilistically profitable as can be seen by the unstaking probability graph shown above, and is most efficient with large unstakers as they create the largest sandwich opportunity. Sometimes it fails as users don't sell, but mostly it works. GMX has been made aware and rewarded me with 500$ for this finding."

• On September 18, 2022 GMX exchange lost $400K in a price manipulation attack.

Governance

Admin Keys

• From DeFi Safety (22-4-2022):

"GMX details their admin control information at this location, which took a bit of searching since it does not reside in their main gitbooks repository, and is instead linked from it. GMX clearly mentions that the logic of their contracts is immutable, but peripheral functions such as fees and pricing calculations can be updated. As such, GMX contracts inherently do not possess an upgradeable structure. GMX contracts are controlled by a controlled account owned by the team. In addition, there is a Multisig consisting of advisors and community members. This multisig is composed of:  - Ben Simon - Han Wen - Krunal Amin GMX identifies all parameters that they can change/upgrade, and to what extent:  - Setting of swap and margin trading fees up to a maximum of 5% - Setting of token weights for the GLP pool, token weights affect the dynamic fees of swaps, these fees are such that a swap which increases the balance towards the specified token weight will be lower, while a swap that moves the token weight away from the desired amounts will have higher fees, the details of the calculation can be found from Vault.vaultUtils.getSwapFeeBasisPoints  - Pausing of swaps or leverage trading for emergency use  - Setting of the maximum allowed leverage  - Setting of maximum total capacity for long and short positions    Additional timelock parameters include:    - Listing of new tokens  - UpdatingVault.priceFeed  - UpdatingVault.vaultUtils, the VaultUtils contract validates the opening and closing of positions and also specifies how fees are calculated  - Updating of gov` values

Along with a clear explanation about the contracts' core logic being immutable, GMX details that any malicious transaction is sent, it is theoretically possible for a draining of all user funds to occur. However, any transaction that can enable this must pass through a rigorous process of internal verification, which leaves a lot of room for finding and mitigating such an event. GMX details this in clear, user friendly language:  

"In the event of a malicious transaction being sent, it is possible for all funds in the pool to be compromised. To mitigate this, all actions which can impact user funds must pass through the signal, time gap, execute process mentioned above. If a malicious transactions is detected through the monitoring process or Bug Bounty, a multi-sig consisting of advisors and community members can be used to override the Timelock.admin value, this would prevent the action from being executed. This also applies for actions such as pausing trading when there was no need to, in this case, the admin can be replaced by the multi-sig and trading can be re-activated".

GMX clearly explains that their pause function can be used to halt swapping or leverage trading. GMX's timelock has a duration of 28 days for token supply upgrades. GMX's additional timelock docs identify a 24 hour timelock for anything upgrade-related. GMX mentions that 24h was selected for this subsequent timelock as it allows them to "respond quickly to any issues that may occur"."

Token

Token Allocation

• From their docs (7-2022):

"The forecasted max supply is 13.25 million GMX tokens. The supply of GMX can be viewed on the Dashboard.

Minting beyond the max supply of 13.25 million is controlled by a 28 day timelock. This option will only be used if more products are launched and liquidity mining is required, a governance vote will be conducted before any changes.

6 million GMX from the XVIX and Gambit migration.

2 million GMX paired with ETH for liquidity on Uniswap.

2 million GMX reserved for vesting from Escrowed GMX rewards.

2 million GMX tokens to be managed by the floor price fund.

1 million GMX tokens reserved for marketing, partnerships and community developers.

250,000 GMX tokens distributed to the team linearly over 2 years."

Utility

Has a dual token system. From the website (22-8-2022):

"GMX is the utility and governance token. Accrues 30% of the platform's generated fees.

GLP is the liquidity provider token. Accrues 70% of the platform's generated fees."

Other Details

• From their docs (7-2022):

"The GMX token has a floor price fund in ETH and GLP. It grows in two ways:

1. GMX/ETH liquidity is provided and owned by the protocol, the fees from this trading pair will be converted to GLP and deposited into the floor price fund
2. 50% of funds received through Olympus bonds are sent to the floor price fund, the other 50% is used for marketing

The current floor price fund is viewable on the Dashboard.

The floor price fund helps to ensure liquidity in GLP and provide a reliable stream of ETH rewards for all staked GMX. As the floor price fund grows, it can also be used to buyback and burn GMX if the (Floor Price Fund) / (Total Supply of GMX) is less than the market price, this would lead to a minimum price for GMX in terms of ETH and GLP."

Technology

• Whitepaper or docs can be found here.
• Code can be viewed here. From DeFi Safety (22-4-2022):

"With 220 commits and 7 branches, GMX's main software repository is robustly developed."

Implementations

• Built on: Arbitrum and Avalanche

How it works

• From Bankless (9-9-2022):

The protocol utilizes a unique model where users can act as the counterparty for traders on the DEX by providing liquidity to a basket of assets. This pool is known as GLP. GLP primarily consists of majors such as ETH and wBTC as well as stablecoins, and is designed to give index-type exposure to LPs.

To open positions on GMX, traders borrow from GLP, with a borrowing fee replacing the traditional funding rate. This, along with fees generated from traders opening positions, liquidations, and swaps are paid out in ETH or AVAX to GLP holders and GMX stakers at a 70/30 split.

• From Bankless (16-8-2022):

"Its perpetual swap markets allowing traders to long or short major tokens with up to 30x leverage. When going long or short on GMX, the minimum leverage possible is 1.1x while the maximum allowed leverage is 30x. To start a perp trade, you’d first provide collateral in the form of one of GMX’s supported collateral types. After this, the protocol’s multi-asset liquidity pool would lend you the necessary funds to open your long or short position."

Fees

• From Bankless (16-8-2022):

"GMX charges an opening fee of 0.1% on your position size and a closing fee that charges the same. There is also an ongoing borrowing fee that margin traders must pay hourly to GMX LPs."

Staking

• From their docs (7-2022):

"Staked GMX receives three types of rewards:

1. Escrowed GMX
2. Multiplier Points
3. ETH / AVAX Rewards

30% of fees generated from swaps and leverage trading are converted to ETH / AVAX and distributed to staked GMX tokens. If you are staking on Arbitrum you would receive ETH, if you are staking on Avalanche then you would receive AVAX. Note that the fees distributed are based on the number after deducting referral rewards and the network costs of keepers, keeper costs are usually around 1% of the total fees.

Also has Escrowed GMX:

"Escrowed GMX (esGMX) can be used in two ways:

1. Staked for rewards similar to regular GMX tokens
2. Vested to become actual GMX tokens over a period of one year

Each staked Escrowed GMX token will earn the same amount of Escrowed GMX and ETH / AVAX rewards as a regular GMX token."

Interoperability

For bridging between Arbitrum and Avalanche you can use Synapse (7-2022).

Oracle Method

• From DeFi Safety (22-4-2022):

"GMX briefly mentions the use of Chainlink and TWAP oracles here. In addition, GMX fully breaks down their price feed architecture in their notion docs.

GMX mitigates front running attacks "through the two step transaction process, swap fees and KeeperDAO integration covered in the "Router" section". This information is documented in the GMX Notion docs. GMX outlines their flash loan exploit mitigation/prevention strategy in their Notion docs."

Roadmap

• Can be found here (7-2022).

Usage

• From Bankless (16-8-2022):

"Has crossed over $2.3B in cumulative volume. The project’s $260M+ total value locked (TVL) on Arbitrum makes it the largest dApp on the largest L2 as it stands today."

Team, Funding and Partners

Team

• Full team can be found [here].
• GMX is run by anonymous developers (22-4-2022).

(:

Knowledge empowers all and will help us get closer to the decentralized world we all want to live in!

Making these free wiki pages is fun but takes a lot of effort and time.

If you have enjoyed reading, tips are appreciated :) This will help us to keep expanding this archive of information.

ETH tip address: 0x83460bE5F218b1520B69D702cE60A1DE37dD8E31