Skip to content

$1,000,000 in security audit grants are live now, Apply here →

Security review · December 2025

Updates Branch

for GMX

Guardian's review of Updates Branch for GMX, published December 2025. The report records 2 findings, including 2 low.

Get a quote Read the full report

Published: December 22, 2025
Review window: December 13, 2025
Language: Solidity
Chains: Arbitrum, Avalanche
Sector: Perpetuals

0 Critical
0 High
0 Medium
2 Low
0 Informational

2 acknowledged

Scope

gmx-io/gmx-synthetics 03b41ba401

Findings 2

L-01 Low Potentially Dangerous Parameter Change Warning Acknowledged

Location
ReaderPositionUtils.sol

Description

The pnlAfterPriceImpactUsd value in the PositionInfo struct has been updated to represent the positionValueInUsd which is distinctly different.

If projects would update to this new version of the reader without updating their struct definitions and the way they handle this value it could cause catastrophic results in their integrating protocol.

Recommendation

Be aware of this and be sure to communicate it with integrators who would use this latest Reader version.

Link to L-01
L-02 Low positionValueInUsd Misses Claimable Collateral Warning Acknowledged

Location
ReaderPositionUtils.sol

Description

The new positionValueInUsd in the Position Reader includes assets like the claimable funding, but not the claimable collateral for a position which could be viewed as similarly part of the aggregate position value.

Recommendation

Be aware of this and consider if the claimable collateral should also be reported in the position value. Otherwise be sure to explicitly document this for consumers of this value.

Link to L-02

More from GMX

All 44 reports

Put your code through the same review.

This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.

Get a quote