SlowMist Analysis: GMX v1 has a design flaw, GLP price can be manipulated by reentrancy attacks

PANews reported on July 10 that in response to the GMX attack, SlowMist analysis pointed out that the root cause of the attack was a design flaw in GMX v1: in this version, short selling operations would immediately update the global short average price (globalShortAveragePrices), and this price would directly affect the calculation of the asset management scale (AUM), thereby enabling attackers to manipulate the pricing of GLP tokens.

The attackers took advantage of this design flaw and used Keeper's function of enabling timelock.enableLeverage during order execution (a prerequisite for creating a large short position). Through a reentrancy attack, they successfully established a large short position, thereby manipulating the global average price, artificially raising the GLP price in a single transaction, and profiting from redemption operations.

According to news from yesterday, GMX stated that it has suspended trading on GMXV1 and the minting and redemption of GLP. About $40 million was stolen.