Guardian's review of GLV Just-in-Time Liquidity for GMX, published August 2025. The report records 7 findings, including 7 informational.
- Published
- Review window
- August 1, 2025
- Chains
- Arbitrum, Avalanche
- Sector
- Perpetuals
- 0 Critical
- 0 High
- 0 Medium
- 0 Low
- 7 Informational
Findings 7
-
NOTE-1 Informational PnL To Pool Ratio Fluctuations Acknowledged
Description
The GLV Shift action will remove a portion of the from market’s pool liquidity and as a consequence the pnl to pool ratio of the from market will experience a stepwise increase.
Given that GLV Shifts use the underlying withdrawal execution code, this will be limited to the
pnlToPoolFactorfor withdrawals. As a result, the pnl to pool ratio of the from market can be a limiting factor on the availability of liquidity for the JIT action.Recommendation
Be sure to consider the current pnl to pool ratio of all markets which could supply liquidity in the off-chain calculation that decides which market to use.
-
NOTE-2 Informational Markets Must Be Up To Date Acknowledged
Description
During the JIT action processing, it should be ensured that both markets are up to date with respect to borrowing/funding and impact distribution to perform accurate validations.
Recommendation
Make sure that any pre-validations that are performed are considering an up to date view of both markets
-
NOTE-3 Informational Block Gas Limit Concern Acknowledged
Description
Combining the GLV Shift gas usage with the execution of an increase order will have a significant gas consumption and may pose issues for the block gas limit on Botanix, Arbitrum, or Avalanche.
Recommendation
Be aware of this issue and be sure to benchmark the gas usage of increase orders that include swaps in the JIT action if that is supported.
-
NOTE-4 Informational Order Execution Affected In The From Market Acknowledged
Description
JIT actions will draw liquidity away from the supplying market. This can have adverse affects on the operations of existing positions and orders in that market.
Notably, market orders which have yet to be executed and limit orders which rely on the backing pool amounts for either 1) swapping actions or 2) open interest reserves, will be affected.
Such orders will fail due to liquidity constraints leading to:
- Failed swap orders
- Failed increase orders by way of failed swaps on increase or lacking reserves
- Failed swaps on decrease orders
Recommendation
Be aware of how this may affect the from market’s existing positions and orders. Ideally the off-chain keeper can consider the pending orders in the from market and surmise how much liquidity should be left there, though this is non-trivial.
-
NOTE-5 Informational JIT Action DoS Acknowledged
Description
JIT actions may be unexpectedly DoS’d by atomic swaps through the gasless transactions router. A user may frontrun a JIT action (or such a swap may naturally happen right before a JIT action), that moves the imbalance in either the from or to market outside of the acceptable range for the GLV shift.
Such a swap may not need to be a significant size if either market is already close to the limits.
Recommendation
This may be acceptable, even for networks with public mempools since there is no immediate gain for the malicious actor. However it is worth keeping in mind when assigning the thresholds for imbalance.
-
NOTE-6 Informational Actions Should Be Restricted To Expected Flows Acknowledged
Description
JIT actions likely only need to be paired with increase position order types. As a result the GMX contracts should limit all other unexpected order types to reduce attack surface.
Furthermore, consider if increase orders which use swaps are expected, if not these orders should be restricted as well.
Recommendation
Add validation to ensure that only the explicit increase order types that should be used are allowed. Consider if increase orders with swaps are expected to be used and validate these as well.
-
NOTE-7 Informational JIT Used To Solve PnlToPoolRatio Acknowledged
Description
One of the main attack vectors introduced by the JIT action is the ability to “lead” liquidity to any target market within a GLV.
As a result of this, a user can affect the
pnlToPoolRatioin the receiving market, causing a stepwise reduction in that market’spnlToPoolRatio.This could be abused to allow a trader to realize more profit if they had their profits capped by the max pnl to pool factor for traders.
This could also be abused to allow LPs to exit if the
pnlToPoolRatiois above the max pnl to pool factor for withdrawals.This puts GLV holders in a bad position, causing them to always be used as the bail out for markets that have a high
pnlToPoolRatio.Recommendation
Validate that the market receiving the GLV Shift is not above the
pnlToPoolRatiofor withdrawals.
No findings match.
More from GMX
All 44 reportsPut your code through the same review.
This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.
