GMX - Rekt

GMX V1 lost about $42 million on July 9 through a cross-contract reentrancy exploit that manipulated globalShortAveragePrices and inflated GLP pricing, according to PeckShield and BlockSec. BlockSec said the GMX order-keeper passed a contract address into executeDecreaseOrder, which let the attacker reenter the reward router and vault during the refund step. PeckShield's post-hack analysis said the bug was introduced in the 2022 fix for a $1M bug bounty paid to Collider VC. GMX later said a potentially exploitable $42 million belonging to GLP holders had been secured, and after paying the attacker a $5 million bounty, the remaining funds were in its Security Multisig.