gmx.io
Summary
GMX V2 Synthetics is a decentralized perpetuals exchange with ~$161M TVL concentrated on Arbitrum ($151M) and Avalanche ($8.9M), using isolated GM pools, keeper-mediated execution, and Chainlink-based oracles. V2 has operated without a confirmed exploit since August 2023, backed by an unusually deep Guardian audit retainer (30+ engagements) and a $5M Immunefi bounty. However, 46% of sampled deployed contracts are unverified—including 100% of Botanix and MegaETH deployments and the primary Chainlink Data Streams provider—source chains grant ROLE_ADMIN to EOAs bypassing DAO timelocks, settlement chains expose CONFIG_KEEPER and TIMELOCK_ADMIN to multiple single-key holders, and oracle/bridge dependencies lack on-chain failover. The July 2025 V1 reentrancy exploit (~$42M, largely recovered) did not affect V2 but raises patch-discipline concerns for the shared contributor set. Overall risk is moderate at 5.9/10, driven by verification gaps, cross-chain governance asymmetry, and dependency concentration rather than settlement-chain exploit history.
Trust Assumptions
Users and LPs must trust that Chainlink price feeds and unverified Data Streams providers deliver accurate, timely prices with no automatic failover if either fails or is manipulated; that permissioned ORDER_KEEPER and Gelato relay infrastructure remains live and uncompromised; that the 5-of-8 Gnosis Safe (0x8D1d2e24eC641eDC6a1ebe0F3aE7af0EBC573e0D) and 24-hour timelocks on Arbitrum/Avalanche will not execute malicious upgrades; that six CONFIG_KEEPER EOAs and two TIMELOCK_ADMIN EOAs on settlement chains will not be compromised to manipulate price-impact parameters or timelock operations; that LayerZero+Stargate cross-chain messaging and peer whitelists are correctly configured; that Botanix and MegaETH EOA ROLE_ADMIN holders (two per chain) will not reconfigure bridge routers or grant themselves CONTROLLER privileges; and that live bytecode on all chains matches audited gmx-synthetics commits despite 25 unverified deployments blocking independent confirmation.
What Could Go Wrong
A compromised CONFIG_KEEPER EOA could set extreme price-impact parameters to extract value from traders and LPs across ~$161M settlement TVL, or a compromised Botanix/MegaETH ROLE_ADMIN EOA could immediately grant bridge CONTROLLER roles and accept fraudulent LayerZero messages—potentially double-minting deposits (a risk explicitly documented in LayerZeroProvider comments with frontend-only mitigation). Chainlink oracle failure or manipulation on a low-liquidity market could trigger incorrect liquidations or bad fills with no on-chain provider failover, echoing the 2022 V1 AVAX manipulation (~$565K). Cross-chain V2.2 infrastructure carries residual risk from Guardian's Low Confidence 2/5 rating (Jul 2025) without a confirmed follow-up audit at production commit, and nascent MegaETH (~2.5 months) and Botanix (~11 months) deployments have not been adversarially tested. Separately, GMX token holders face suspended staking rewards until $90 with reported single-holder governance concentration and ~17% unminted esGMX vesting headroom creating sell-pressure risk unrelated to perps contract safety.
Recommendation
Treat Arbitrum and Avalanche settlement-chain perps and GM/GLV LP positions as acceptable for moderate allocation given V2's clean ~2.8-year exploit record, reentrancy hardening, and strong audit posture—but size positions cognizant of oracle single-point-of-failure, keeper liveness, and EOA privileged roles. Avoid or strictly limit exposure via Botanix and MegaETH until contracts are verified on-chain and ROLE_ADMIN is migrated to multisig-plus-timelock governance matching settlement chains. Monitor: (1) block-explorer verification status for ChainlinkDataStreamProvider and Avalanche DataStore, (2) RoleStore changes to CONFIG_KEEPER, TIMELOCK_ADMIN, and source-chain ROLE_ADMIN, (3) Chainlink feed staleness and sequencer uptime on Arbitrum, (4) cross-chain router upgrades and Guardian follow-up audit publication, and (5) any V1/V2 shared infrastructure changes post-July 2025. Reduce exposure if unverified contract count rises, source-chain EOAs rotate, or a V2 incident occurs; the $5M Immunefi bounty and Guardian retainer are meaningful offsets but do not substitute for bytecode verification on live deployments.
Key Findings (30)
Analysis Sections
GMX V2 settlement chains (Arbitrum, Avalanche) deploy a real OpenZeppelin ProtocolGovernor with 24-hour timelocks and a 5-of-8 Gnosis Safe execution multisig, but discovery/docs overstate decentralization (claimed 2-of-3 multisig). Source chains Botanix and MegaETH lack on-chain governors and grant ROLE_ADMIN to EOAs. Twenty-five contracts in scope are unverified, including all Botanix/MegaETH deployments and legacy timelock addresses.
Findings (13)
Botanix and MegaETH deployments have no ProtocolGovernor, ConfigTimelockController, or token-governed timelock. Cross-chain routing (LayerZero multichain routers) and core handlers on these chains are controlled exclusively via RoleStore roles, bypassing the Arbitrum/Avalanche DAO path that docs describe as community-governed.
On Botanix, the two ROLE_ADMIN holders (0x3d6BA4a91Ffde7C519379F8dCA5FE58b7125c294 and 0x72A30e76827Ce83CeF0b1bEd7e9aaF9F4A576990) are externally owned accounts, not Gnosis Safes. ROLE_ADMIN can grant or revoke every protocol role in RoleStore, including CONTROLLER and CONFIG_KEEPER, enabling immediate privilege escalation without timelock or token vote.
MegaETH mirrors Botanix: two EOA addresses (0x9d5f3fac443748c28FB5dc964D74F8419F686F6D, 0xbF96f66932C1D826C172a80be7c062Ab6B26a4CC) hold ROLE_ADMIN with no multisig or timelock wrapper. With ~$760K TVL on MegaETH and cross-chain message paths, compromised keys could reconfigure bridge routers and handlers.
Discovery reports a 2-of-3 Gnosis Safe executing Snapshot votes. On-chain verification of TIMELOCK_MULTISIG holder 0x8D1d2e24eC641eDC6a1ebe0F3aE7af0EBC573e0D shows a 5-of-8 Safe on both Arbitrum and Avalanche (8 owners, threshold 5). Botanix additionally uses a separate 5-of-8 Safe (0x656fa39BdB5984b477FA6aB443195D72D1Accc1c) with a partially overlapping but distinct signer set.
Both the governor timelock (Arbitrum 0x4bd1cdAab4254fC43ef6424653cA2375b4C94C0E, Avalanche 0xC55e165Bf9247256DBeCA8DDE892aE9a7B271b2D) and ConfigTimelockController (Arbitrum 0xC77E6C0ca99E02660A23c00A860Dd5a8912DEaF5) enforce getMinDelay()=86400 seconds (24 hours). For a ~$161M TVL derivatives protocol, this is a relatively short delay window for malicious or erroneous upgrades.
RoleStore grants CONTROLLER to 40 addresses on Arbitrum, 38 on Avalanche, 34 on Botanix, and 34 on MegaETH. CONTROLLER can mutate DataStore state (setUint, setAddress, setBool, etc.) per contract source. Handler and router upgrades rely on adding new CONTROLLER members rather than immutable logic, creating a large attack surface if any controller contract is compromised.
TIMELOCK_ADMIN role is assigned to four EOAs (0x8D1d2e24eC641eDC6a1ebe0F3aE7af0EBC573e0D, 0x35EA3066f90dB13e737Bbd41f1eD7B4BfF8323B3, 0xe014CBd60A793901546178E1c16AD9132c927483, 0x58F582455B54D7c83d03BceED95FAF72b37fddd7) on both Arbitrum and Avalanche. Only the first is the 5-of-8 Safe; the other three are single-key EOAs with timelock administration privileges per RoleModule.onlyTimelockAdmin.
Per VERIFICATION_STATUS.md, 25 of 54 scoped contracts lack verified source locally: all 9 Botanix, all 8 MegaETH, Arbitrum legacy Timelock (0x7A967D114B8676874FA2cFC1C14F3095C88418Eb), deployer EOA, ChainlinkDataStreamProvider, and several Avalanche core contracts (DataStore, Oracle, MultichainVault, ProtocolGovernor, Timelock). Unverified bytecode cannot be statically audited and may diverge from the gmx-synthetics repo.
ProtocolGovernor.timelock() on Arbitrum points to 0x4bd1cdAab4254fC43ef6424653cA2375b4C94C0E (OZ TimelockController, 24h, governor is proposer+executor), not the discovery-listed Timelock 0x7A967D114B8676874FA2cFC1C14F3095C88418Eb. The listed address is a legacy custom Timelock contract (Etherscan name: Timelock) that does not expose getMinDelay(). Operational config changes route through ConfigTimelockController where the 5-of-8 Safe is PROPOSER_ROLE.
Arbitrum deploys ConfigTimelockController (0xC77E6C0ca99E02660A23c00A860Dd5a8912DEaF5) as ROLE_ADMIN and multisig-gated config executor. Avalanche has no equivalent contract in discovery or RoleStore ROLE_ADMIN set (only 0x20D56cf90fD3C8f3bEb9BAC03AfdA3241093DE36 timelock and 0x37E1aeb6118B0106810d2Ef7662875c414E39CA4 TimelockConfig). Cross-chain governance parity between settlement chains is incomplete.
ProtocolGovernor on Arbitrum shows 20 ProposalCreated events with the most recent in March 2026. Parameters verified on-chain: votingDelay=1 day, votingPeriod=5 days, proposalThreshold=30,000 GMX (GovToken 0x2A29D3a792000750807cc401806d6fd539928481), quorum=3%. Primary documented workflow remains Snapshot (gmx.eth) signaling followed by multisig execution via ConfigTimelock, making the on-chain governor a parallel rather than sole authority.
DataStore and RoleStore have no owner() or upgrade proxy; access control is exclusively via RoleStore roles (ROLE_ADMIN, CONTROLLER, CONFIG_KEEPER, TIMELOCK_MULTISIG, etc.). ROLE_ADMIN on Arbitrum is held by timelock contracts (governor timelock, ConfigTimelockController, TimelockConfig 0x4A1D9e342e2Db5F4a02C9eF5Cb29cAF289F31599), aligning with stated immutability for core state storage.
The unverified deployer EOA 0xe7bfff2ab721264887230037940490351700a068 holds ~2 ETH on Arbitrum but has no RoleStore roles (ROLE_ADMIN, CONTROLLER, CONFIG_KEEPER, TIMELOCK_MULTISIG all false). Residual risk is limited to future transactions from this key, not current privileged access.
Governance Checklist
On-Chain Governance Parameters
ROLE_ADMIN Control by Chain
| Chain | ROLE_ADMIN holders | Controller type | Risk |
|---|---|---|---|
| Arbitrum | Governor timelock, ConfigTimelock, TimelockConfig | Timelock contracts | Low |
| Avalanche | Governor timelock, TimelockConfig | Timelock contracts | Low–Medium |
| Botanix | 2 EOAs | Single-key accounts | High |
| MegaETH | 2 EOAs | Single-key accounts | High |
Verified Execution Multisigs
Unverified Contracts (Governance/Ops Relevance)
| Chain | Address | Name | Governance relevance |
|---|---|---|---|
| arbitrum | 0x7A967D114B8676874FA2cFC1C14F3095C88418Eb | Legacy Timelock | Listed governance contract; non-OZ interface |
| arbitrum | 0xe7bfff2ab721264887230037940490351700a068 | V2 Deployer EOA | Deployment key; no current roles |
| arbitrum | 0xE1d5a068c5b75E0c7Ea1A9Fe8EA056f9356C6fFD | ChainlinkDataStreamProvider | Oracle provider; parameter trust |
| avalanche | 0x2F0b22339414ADeD7D5F06f9D604c7fF5b2fe3f6 | DataStore | Core state; cannot audit locally |
| avalanche | 0xE1d5a068c5b75E0c7Ea1A9Fe8EA056f9356C6fFD | Oracle | Price feed admin path opaque |
| avalanche | 0x6D5F3c723002847B009D07Fe8e17d6958F153E4e | MultichainVault | Cross-chain custody |
| avalanche | 0x226ED647C6eA2C0cE4C08578e2F37b8c2F922849 | ProtocolGovernor | On-chain DAO controller |
| avalanche | 0xdF23692341538340db0ff04C65017F51b69a29f6 | Timelock | Listed governance contract |
| botanix | 0xA23B81a89Ab9D7D89fF8fc1b5d8508fB75Cc094d | DataStore | Core state on source chain |
| botanix | 0x51Aa17ca59E9e9C3cEc3c3c05c2B35f473b35D39 | RoleStore | All roles including EOA ROLE_ADMIN |
| megaeth | 0xE43C7B694f6b652a9F4A0f275C008d18758Dce35 | DataStore | Core state on source chain |
| megaeth | 0xecA46636BDDbb4F451ca2B7062C7E36744934655 | RoleStore | EOA-controlled ROLE_ADMIN |