Decentralized exchange (DEX) GMX allegedly experiences price manipulation on the AVAX/USD pair in key exchanges.
Open interest in AVAX long perpetualĀ futuresĀ has accordingly been capped at $2 million, while open interest in AVAX short perpetual futures has been limited to $1 million.
Perpetual futuresĀ are a type of open futures contract without a settlement date. GMX offers spot and perpetual futures, with more than $342 millionĀ locked upĀ onĀ Arbitrum, a layer-two ETH solution, and $67 million on Avalancheās blockchain.
Layer-two solutions likeĀ ArbitrumĀ help improveĀ EthereumĀ scalability by bunching up transactions and transmitting them to layer-one as a single transaction. Doing so reduces Ethereum transaction costs and congestion.
GMX is a decentralized exchange that offers a low fee for perpetual futures and spot trading. It runs on Arbitrum andĀ Avalanche. It allows users to borrow up to 30x their initial margin to amp up futures betting. GMX receives aggregated prices for its assets usingĀ Chainlink price oracles.
Attack vector allegedly compromises AVAX price
Earlier today, blockchainĀ securityĀ company PeckShield announced onĀ Twitter, āSeems like $GMX on Avalanche exploited, resulting in ~$565k profit. Be Alert.ā The company has since deleted the tweet, with GMXĀ tweetingĀ that they are reviewing the situation.
Another Twitter user, @derpaderpederp, alsoĀ notedĀ the alleged issue,ā Seems likeĀ @GMX_IOĀ got exploited onĀ $AVAXĀ and are now drastically reducing OI availability onĀ $AVAXĀ trading. Very bad management of theĀ @GMX_IOĀ team after they were warned weeks and months ahead.ā
In response to GMXās announcement, one Twitter userĀ commented, āHow exactly can this vector of attack be mitigated since the price manipulation can happen off-site? So long the exchange uses a price oracle any mitigation actions will be post-fact.ā
Zig-Zag co-founder weighs in
On Sep. 3, 2022, Twitter user and founder of Zig-Zag @derpaderpederp said that anyone with intimate knowledge of GMX could manipulate the price of ETH, or in this case, AVAX sinceĀ tradingĀ incurs no price impact on GMX. The DEXās website says,ā Enter and exit positions with minimal spread and zero price impact.ā A spread is a difference between an assetās buy and sell rate.
They could take a long position, buying $50 million of AVAX on GMX. They could then buy $40 million of AVAX on a centralized exchange likeĀ BinanceĀ or Coinbase at an elevated buy price. Upon closing the long position on GMX and receiving a profit, they could open up a $20 million AVAX short position and sell $40M of AVAX back to the centralized exchanges at a discount, pocketing a further profit.
This process can be repeated multiple times, draining the liquidity of GLP, the liquidity provider token on the GMX. GLP holds an index of assets used in leveraged trading on the platform. It can be minted using any index asset and burnt to redeem an index asset.
At press time, the companyĀ had notĀ provided a way forward following the alleged hack.