DeFi Trader Nets Over $500K by Using DEX GMX to Manipulate Avalanche Token

A savvy crypto trader deployed millions of dollars to manipulate the prices of Avalanche’s AVAX tokens on the decentralized exchange (DEX) GMX, taking profits of upwards of $500,000 by utilizing a strategy that exploited a basic loophole.

GMX, like other DEXs, relies on smart contracts to match traders between decentralized finance (DeFi) users. Decentralized finance refers to trading activities carried out on a blockchain without the use of a third party.

DEX allows users to trade spot and perpetual futures using its on-chain trading interface at low fees and has processed more than $45 billion in trading volume since its inception in 2021.

However, the loophole is that GMX offers trading to users at zero slippage, or the difference between the expected price of a trade and the price at which the trade is executed. But all pricing data on GMX is derived from centralized exchanges, such as Binance or FTX, meaning a trader could buy a large number of tokens, such as AVAX in this case, on zero slippage, rapidly drive up prices on centralized exchanges by placing buy orders on those venues and selling the initial position on GMX at higher prices.

@GMX_IO should have honestly put a cap way earlier to avoid those issues due to 0% price impact, not hard to do, especially that you have been warned and aware that such manipulations were possible. pic.twitter.com/m2RjTsc6uh

— Atlas (@AtlasIsMe) September 18, 2022

It’s important to note that this strategy will not work on two centralized exchanges, as a trader placing high bids on one venue would mean prices automatically move higher on that exchange and other exchanges immediately raise the price of assets on their own systems – meaning the strategy is unlikely to net any profits.

In several tweets on Sunday, Genesis Trading head of derivatives Joshua Lim said the trader exploited the GMX loophole some five times, netting over $500,000 to $700,000 in total profits. Security firm PeckShield also pegged the gains at $565,000 on Sunday morning in a tweet that’s since been deleted.

The trader put on positions of between $4 million to $5 million each time, Lim said, and extracted over $158,000 in the first trade they did. He added that this wasn’t a typical exploit as GMX worked “as designed.”

5/ this isn't an exploit as much as GMX working as designed! X executed large trades in against GLP holders with 0 slippage: at the oracle price without factoring any price impact

in the real world, putting on risk requires you to pay liquidity providers on the opposite side

— Joshua Lim (@joshua_j_lim) September 18, 2022

GMX developers said late Sunday that they were reviewing the loophole and had, in the meantime, capped open interest, or the number of unsettled futures contracts, at $2 million for AVAX on their exchange. A key developer said a solution can be expected some two weeks from now.

GMX’s native tokens fell 12% in the past 24 hours amid a broader market decline, extending two-week losses to over 30%, data shows.