GMX Keeper Review
Offchain automation case study
“Guardian has been an integral part of the growth of GMX and our ecosystem of protocols who also rely on them for audits. Having Guardian as a strategic partner has allowed us to move more quickly while keeping security as our highest priority.”
CoinflipcanadaGMX
Overview
Between January and June 2026 Guardian re-reviewed the entire GMX V2 codebase as part of the V2.2 re-review. Alongside the 27,800 source lines of contracts sat a second scope that decides whether those contracts ever run: the keeper service, the offchain automation that executes every order, liquidation and deleveraging on the exchange.
Guardian
Guardian provides institutional-grade security for digital asset teams, onchain and off. Every engagement runs two independent teams, backed by Helix, Guardian's AI auditor, and only human-verified findings reach the client.
GMX
GMX is a decentralized perpetuals and spot exchange with over $500B in lifetime volume. Its V2 contracts never act on their own: every request a trader makes waits for a keeper to pick it up, price it and execute it.
Why keepers need their own review
A keeper holds a funded key and decides, unattended, what to submit and when. A defect in a contract corrupts state; a defect in a keeper can stop the exchange outright, or execute the wrong thing at the worst moment. Liquidations that do not fire, a deleveraging sized from the wrong numbers, an order that never runs: none of these show up in a contract audit, because the contract behaves exactly as written.
GMX's keeper also re-derives much of the contracts' pricing and risk math in TypeScript, to decide what is executable before it spends gas. Every one of those re-derivations is a place the offchain copy can drift from the onchain original.
Scope
- Order execution: market, limit and stop orders, and the checks that decide when each is executable
- Liquidations and auto-deleveraging (ADL), including how positions are selected and sized
- The GLV rebalancer
- Funding-rate and risk-oracle executors
- Fee and buyback automation
- The keeper's HTTP API and signed-price service, plus its container and dependencies
How Guardian approached it
- A contract lead on offchain code. The review was led by a researcher who has audited gmx-synthetics since 2022, reading each keeper calculation against the Solidity it mirrors rather than on its own terms.
- A web2 specialist beside them. A dedicated offchain researcher took the API, the service's inputs and its infrastructure, the surface a contract researcher is least likely to probe.
- A fuzzing harness for the keeper. Guardian built a separate fuzzing suite that runs keeper logic against the contracts' own behaviour, so divergence between the two shows up as a failing property rather than a hunch.
Results
The keeper review returned 55 findings, eight of them High severity. All eight Highs were resolved.
- Critical: 0
- High: 8
- Medium: 26
- Low: 17
- Informational: 4
Most of the Highs sat exactly where the approach aimed: places where the keeper's offchain picture of a position or market disagreed with what the contracts would do with it. Finding details remain private to GMX.
Impact
- The automation that every GMX trade depends on was reviewed to the same standard as the contracts it drives
- Drift between keeper and contract math became a testable property, through a harness GMX can keep running
- Offchain and onchain findings from the same re-review landed together, so fixes on one side were checked against the other
Read the full four-year relationship in the GMX client story.
Running keepers, bots or relayers of your own? Guardian's Offchain Automation Audit reviews them from the source.