Decentralized exchange (DEX) GMX has reportedly suffered price manipulation by an exploiter who managed to steal about $565,000 from the AVAX/USD market.
An unknown exploiter is believed to have taken advantage of GMX’s “minimum spread” and “zero price impact” features to carry out an exploit that affected GLP token holders who provided GMX with liquidity in the form of AVAX (Avalanche token).
GMX confirmed the price manipulation exploit in a September 18 Twitter post, but stated that the AVAX/USD market will remain open despite the $2 million limit on long positions and the $1 million limit on short positions.
We have been made aware of AVAX/USD price manipulation on reference exchanges by monitoring systems and community members.
As we review this event, open interest in AVAX has been capped at $2M long / $1M short.
The GLP and GMX trading markets continue to operate as usual.
— GMX (@GMX_IO) September 18, 2022
Joshua Lim, Head of Derivatives at Genesis Trading, was one of the first to analyze the exploit, stating that the exploiter “successfully profited from the AVAX/USD GMX market by entering large positions with zero slippage” before moving AVAX/USD to centralized exchanges on slightly higher price.
Lim said this exploit method was repeated five times, with the first cycle taking effect at 01:15 UTC on September 18. Each cycle transferred more than 200,000 AVAX tokens (approximately $4–5 million per cycle), with the attacker extracting about $565,000. into profit after paying out the spread to market makers on other exchanges.
3/ let’s look at the first cycle, which ran from 01:15:31 to 01:28:11 UTC. X was able to make roughly $158K in profits trading $4-5M clips at a time pic.twitter.com/W6eu7Iz6lz
— Joshua Lim (@joshua_j_lim) September 18, 2022
However, Lim noted that this was not “exploitation” as “GMX worked as intended.”
The technical analyst at Duo Nine added that the exploiter was able to take advantage of several large deals with GLP holders because the fixed prices provided by the oracles operated by Chainlink do not affect the price, which made the use of price manipulation possible.
“If traders make a profit, liquidity providers lose. If traders exploit this vulnerability, GLP holders could lose all their money!”
While GMX immediately capped short and long open interest on AVAX/USD to protect the DEX from further manipulation, Lim said GMX may have to drop its “zero price impact” feature despite To date, it has successfully connected many users.
“The real problem is that GMX doesn’t reflect the real cost of liquidity like other exchanges do, it offers unlimited liquidity at an average oracle price.”
The recent exploit comes just weeks after Layer-2 DEX ZigZag founder “Taureau” stated in a Sept. 2 video call that he doubted the GMX exchange model would be sustainable in the long run, adding that a trader with the right strategy could wipe out holders. GLP tokens:
Has $GMX created a viable system in the long run?
ZigZag founder @taureau_21 has doubts… and predicts that eventually a trader with the right strategy and the right size will wipe out $GLP.
Full episode pic.twitter.com/MF2Qafxs57
— Flywheel (@flywheelpod) September 2, 2022
Related: What are decentralized exchanges and how do DEXs work?
This news caused a mixed reaction from the GMX community. One Twitter user highlighted the fact that no smart contract was used, while another Twitter user asked GMX if any compensation would be paid to affected GLP holders.
On GMX, liquidity providers supply BTC, ETH, AVAX, and stablecoins in exchange for the GLP token. The protocol was launched in late 2021 on Arbitrum’s scalable Tier 2 Ethereum network.
The GMX token (GMX) is currently worth $39.07, down 16.7% from the last 24 hours, according to CoinGecko.