TL;DR verdict
GMX is a mid-risk perpetuals DEX. It has operated since 2021 and holds roughly $0.18B in TVL, audited by ABDK, Quantstamp, and Guardian Audits. Its record is not clean, however: on 9 July 2025 GMX V1 was exploited for approximately $42M via a reentrancy attack on the GLP pool on Arbitrum. The attacker later returned the funds (keeping a ~10% whitehat bounty), and GMX V2 was unaffected, but the incident demonstrates that audited perps code can still fail. Perps DEXs also depend on accurate oracles and can be affected by cascading liquidations; these risks are mitigated but not eliminated.
Audit history
GMX has undergone audits by three independent security researchers: ABDK, Quantstamp, and Guardian Audits. Each firm reviewed the core GMX v1 and v2 smart contracts, focusing on the GLP/GM liquidity pools, trading logic, and fee mechanisms. No specific dates or findings counts are publicly available, but the involvement of tier-one auditors is a strong signal of proactive security. The codebase has also been open for public review since launch, inviting community scrutiny.
Incidents and exploits
GMX suffered a major exploit on 9 July 2025. An attacker drained approximately $42M from the GMX V1 GLP pool on Arbitrum by abusing a refund-based reentrancy in the executeDecreaseOrder path combined with an internal accounting desynchronization in GLP pricing: reentering to open a large short caused globalShortSizes to update before the average price did, inflating computed AUM so redeemed GLP extracted more assets than deserved. GMX halted V1 trading and minting and offered a 10% whitehat bounty; the attacker subsequently returned the funds. GMX V2 and other protocol components were not affected. Aside from this incident and earlier minor issues (e.g., a 2022 AVAX price-impact episode), GMX has otherwise avoided catastrophic losses, but the July 2025 exploit is a material part of its record.
Smart contract risks
The GMX codebase is mature (launched 2021) and heavily used, reducing the probability of undiscovered critical bugs. However, smart contract risk is never zero. Upgrades are controlled by the GMX DAO via a multisig; governance token holders vote on changes, but the multisig introduces a centralization vector. Oracle dependencies: GMX relies on Chainlink price feeds for positions; an oracle malfunction or manipulation could trigger incorrect liquidations. The v2 isolated markets feature allows customized risk parameters, which, if misconfigured, could create vulnerabilities.
Operational and counterparty risks
GMX is governed by a DAO with anonymous or pseudonymous contributors, which limits accountability. Regulatory risk is moderate: derivatives protocols face uncertain legal treatment in many jurisdictions. Insurance is not native; projects like Nexus Mutual offer coverage on a case-by-case basis. The protocol’s viability links to the liquidity providers in GLP/GM vaults—a collapse in LP confidence could impair trading and TWAP executions.
How to use it more safely
- Use a hardware wallet and review all contract approvals.
- Position size conservatively: leverage amplifies both gains and losses.
- Monitor governance proposals and protocol changes via the GMX forum and Snapshot.
- Diversify across multiple perps venues (e.g., Hyperliquid Hyperliquid, dYdX dYdX) to reduce single-protocol exposure.
- Avoid trading during extreme volatility when oracle updates may lag.
- Track the GMX insurance fund and whether third-party coverage (e.g., Nexus Mutual) is available.
Verdict
GMX remains a widely used decentralized perps platform, but the July 2025 V1 exploit (~$42M) tempers its safety score to 6.5 out of 10. The near-full recovery of funds and the fact that V2 was unaffected are mitigating factors, and its audits and transparency are genuine strengths. Still, the exploit shows that GMX is not immune to critical smart-contract failures. Users should prefer the unaffected V2 markets, size positions conservatively, and treat smart-contract risk as demonstrated rather than hypothetical.
DeFi Intel publishes editorial research, not financial advice. Smart contract risk is never zero. Do your own research and consider position sizing accordingly.