GMX V1's $42M Reentrancy Scare Turns Out to Be a Rescue in Disguise

On July 9th, roughly $42 million left GMX's V1 GLP pool on Arbitrum through a cross-contract reentrancy flaw that had gone unnoticed despite two years of live operation and two separate audits.

The mechanism was straightforward once unpacked: an attacker manipulated global short average prices to inflate the GLP token's calculated value, then used that inflated valuation to mint and redeem GLP for profit. GLP holders watched liquidity drain in real time as a portion of the funds moved to Ethereum and was swapped into DAI.

Circle, predictably, did not move quickly to freeze the stolen stablecoins. GMX halted V1 trading and minting and floated a standard 10% recovery bounty, even though by then the vault appeared drained.

Then the story took an unexpected turn.

How the reentrancy worked

PeckShield raised the alarm on Wednesday, July 9th, reporting $42 million exploited with $9.6 million already bridged to Ethereum. Minutes later, BlockSec posted the attack transaction, flagging it as worth deeper analysis. GMX confirmed the incident shortly after: approximately $40 million in tokens had moved out of the GLP pool on Arbitrum to an unidentified wallet. Trading and minting were paused on both Arbitrum and Avalanche, with the team stating V2 was unaffected.

While GMX worked with security partners, the stolen funds were already moving — the attacker swapped $5 million USDC for DAI through CoW Protocol.

A detailed breakdown from EVMHacks' three-part Telegram thread traced the root cause to a circular dependency in GMX's design: global short positions fed into AUM (assets under management) calculations, AUM determined GLP pricing, and GLP pricing enabled liquidity operations that could in turn move those same global short positions. SlowMist's writeup pinned the flaw on how short position operations immediately updated globalShortAveragePrices, which fed directly into AUM and therefore GLP token pricing.

The attacker exploited the keeper's ability to call timelock.enableLeverage during order execution — a step required before opening large short positions — and then targeted a weakness in GMX's executeDecreaseOrder() function. That function was called legitimately by GMX's order-keeper, but it accepted an arbitrary contract address as an input parameter. That design let the keeper unknowingly hand execution control to a contract the attacker deployed.

When the keeper executed the function against that malicious contract, it triggered a callback — gmxPositionCallback() — back into the attacker's code. From there, the attacker reentered GMX's reward router and vault mid-transaction, manipulating internal state before the original transaction could finalize. BlockSec described the mechanism plainly: the order-keeper's transaction passed a contract address as the first parameter of executeDecreaseOrder, and the attacker used reentrancy from there to carry out the attack. William Li noted that the keeper's refund step specifically was the point repurposed to hijack execution — by substituting a malicious contract where a normal user address was expected, the attacker chained multiple actions inside a single transaction, a scenario GMX's architecture had not accounted for.

The actual exploitation sequence was simple once the door was open: mint GLP, open short positions, withdraw GLP. The underlying math flaw was that when a short position was opened, the total short size updated immediately, but the average short price did not update in the same atomic step — it stayed pinned to earlier, lower market prices. This mismatch created a phantom short position that the system read as opened at historical lows, inflating the AUM calculation and making GLP look more valuable than it actually was. The attacker cycled mint-and-redeem operations to compound this artificial pricing gap into real extracted liquidity.

Where the exploit actually came from

The attacker's operational wallet was funded two days before the exploit via the Mayan Swift Bridge.

Primary attacker address: 0xDF3340A436c27655bA62F8281565C9925C3a5221

Attack contract: 0x7D3BD50336f64b7A473C51f54e7f0Bd6771cc355

Initial funding transaction: 0xbb4188bcd0153a9572f009db6c49a07ce67e6a032f8cc1f745cef2c51fd32f62

Attack contract deployment: 0xa4ece5a7f106f2fa62dbd0d03441183aeb650d8f587e5c1706e1e5488cd4c93f

Main exploit transaction: 0x03182d3f0956a91c4e4c8f225bbc7975f9434fab042228c7acdc5ec9a32626ef

The two contracts targeted were the GMX Vault (0x489ee077994b6658eafa855c308275ead8097c4a), which held the exploitable globalShortAveragePrices data, and the GLP Manager (0x321f653eed006ad1c29d174e17d96351bde22649), which translated the manipulated vault data into inflated GLP pricing.

PeckShield tracked $9.6 million of the proceeds bridged to Ethereum, where laundering began almost immediately through CoW Protocol — including the $5 million USDC-to-DAI conversion: 0xce269bdfec9a489239749586fe9dcb1433eeb275aad8accdcec612224fa6eaeb.

A fix that planted its own bug

A later PeckShield analysis traced the vulnerability's origin to 2022. The cross-contract reentrancy that enabled the $42 million exploit was not a fresh design flaw — it was introduced when GMX patched an unrelated $1 million bug bounty issue paid out to Collider VC. That 2022 Collider bug centered on the same underlying issue: non-atomic updates between global short size and average global short price. In fixing it, GMX inadvertently created the exact conditions that would later enable the much larger 2025 exploit. PeckShield confirmed directly: "the bug was indeed introduced in the fix for the $1M bounty issue." GMX itself acknowledged that any V1 fork that had copied the patched codebase likely inherited the same flaw.

Audits that never saw the change

Both of GMX's published audits turn out to be out of scope for this exploit. ABDK's April 2021 audit reviewed "Gambit," the pre-GMX version, which had none of the complex keeper flows or GLP mechanisms involved here. Quantstamp's September 2022 audit covered vault implementations but did not examine the keeper callback pathways, globalShortAveragePrices manipulation, or the circular AUM dependency that mattered.

Multiple changes were made to the codebase after these audits without further review: OrderBook.sol gained "additional override on functions" including executeSwapOrder, executeIncreaseOrder, and executeDecreaseOrder — the very function later used as the attack vector. PositionManager.sol's function call order changed, with enableLeverage moved ahead of executeDecreaseOrder. Vault.sol was substantially reworked, including new logic for _increaseGlobalShortSize. RewardTracker.sol picked up new storage variables, and Timelock.sol gained additional functions along with a permission change from onlyAdmin to onlyAdminOrHandler. In short: the code moved: the audits didn't follow.

The aftermath — and the reversal

GMX sent an on-chain message to the exploiter offering a 10% bounty (about $4 million), a 48-hour deadline, and no legal pursuit if the funds were returned (message transaction).

Circle was slow to freeze the funds despite reportedly holding over $30 million in USDC tied to the incident, as noted by security researcher "ultra". ZachXBT criticized the delay directly, noting Circle failed to freeze over $9 million in USDC for one to two hours after a $40 million exploit, during which the attacker also used CCTP to bridge funds from Arbitrum to Ethereum.

GMX continued to reassure users that V2 was unaffected, with V1 trading still suspended on both Arbitrum and Avalanche pending assessment. The next day, GMX published a formal post-mortem titled "GMX V1 Exploit on Arbitrum: Root Cause and Next Steps," confirming the cross-contract reentrancy mechanism and disclosing the specific numbers: BTC's average short price had been manipulated down from $109,505.77 to $1,913.70, which inflated GLP's price from $1.45 to over $27. The same statement outlined next steps for handling remaining funds and possible reimbursement.

Two days after the initial disclosure, GMX published a follow-up that reframed the entire event. According to that statement, the security vulnerability in the GMX V1 codebase had been disclosed, and GMX "would like to recognize the actions of 0xDF3340A436c27655bA62F8281565C9925C3a5221 in this recovery." The $42 million that had been exposed to potential exploitation by GLP holders was secured; after a $5 million bounty was paid to the address, the remaining funds were placed in the GMX Security Multisig.

In other words, what initially read as one of DeFi's larger hacks appears to have been a coordinated white-hat-style recovery — the actor who found and used the exploit ultimately returned the bulk of the funds rather than keeping them, following payment of the bounty.

The larger lesson

The reentrancy bug had been sitting dormant since 2022, planted by a fix meant to close a different, smaller bug. Two years of production use, two audit engagements, and established market standing did not stop a self-inflicted vulnerability from nearly draining the GLP pool. Every unreviewed code change made after the last audit was effectively an unverified assumption baked into a live system holding user funds — and in July, that assumption was tested. This time, the outcome diverged from the usual pattern: rather than a clean loss, the incident resolved with most of the funds recovered and secured.