Guardian's review of Multichain Referral Codes for GMX, published November 2025. The report records 1 finding, including 1 medium.
- Published
- Review window
- November 10 to 11, 2025
- Chains
- Arbitrum, Avalanche
- Sector
- Perpetuals
- 0 Critical
- 0 High
- 1 Medium
- 0 Low
- 0 Informational
Scope
Findings 1
-
M-01 Medium Code Registration Censoring Frontrunning Acknowledged
Description
Referral codes are first come first serve in GMX, and when a user initiates a cross-chain action to register a referral code they advertise the code they are looking to register in the composed message that is bridged.
In the time before the bridged composed message is executed, another user could register the referral code immediately directly through the MultichainOrderRouter
registerCodefunction which is open to be called natively on Arbitrum.The user could also register a referral code through the
ReferralStoragecontract directly.For unsuspecting users they may see that the referral code has been registered, without being aware that it was actually registered for another user.
Recommendation
Be aware of this frontrunning case and be sure to make users aware if their code was frontran and registered by another user. Otherwise encourage users to register codes directly on Arbitrum to avoid frontrunning risks.
No findings match.
More from GMX
All 44 reportsPut your code through the same review.
This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.