GMX Crosschain V2.2 3 Report
Audit · firm’s term: security review
Part of Guardian Audits’ series
Guardian Audits reviewed GMX (GMX Crosschain V2.2 3 Report) on 26 Jul 2025: 70 findings, 3 critical; 42 marked fixed, 28 acknowledged.
Findings70
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 3 |
| High | 0 | 0 | 6 |
| Medium | 0 | 4 | 9 |
| Low | 0 | 24 | 24 |
CriticalAnyone Can Drain Multichain GM Token’s BalanceFixed
The report gives no description here.
CriticalAnyone Can Drain The Multichain BalanceFixed
The report gives no description here.
CriticalArbitrary Execution & Balance Drain RiskFixed
The report gives no description here.
HighMax Impact Caps Double Count Lent AmountsFixed
The report gives no description here.
HighOverflow DoS In withdrawFromPositionImpactPoolFixed
The report gives no description here.
HighPending Amounts Errantly Capped To ZeroFixed
The report gives no description here.
HighPositive Impact Becomes UnbackedFixed
The report gives no description here.
HighUnclear Lending ConstraintsFixed
The report gives no description here.
HighWrong Token Is Used In bridgeOutFromControllerFixed
The report gives no description here.
MediumComposed Deposit CensoringFixed
The report gives no description here.
Show 10 more
MediumImpact Pool Withdrawals Use An Invalid RatioFixed
The report gives no description here.
MediumImpossible To Execute Some Timelock ActionsFixed
The report gives no description here.
MediumIncorrect Atomic Oracle Provider HandlingFixed
The report gives no description here.
MediumMalicious Token Gas Griefs KeepersFixed
The report gives no description here.
MediumMax Lent Bypassed By Splitting OrdersFixed
The report gives no description here.
MediumPending Price Impact Can Be LostFixed
The report gives no description here.
MediumUnnecessary Relay Fee ChargedFixed
The report gives no description here.
MediumUntrusted srcChainIdFixed
The report gives no description here.
LowDuplicated CodeFixed
The report gives no description here.
LowEarly Return Should Include Equality OperatorFixed
The report gives no description here.
Show 10 more
LoweidToSrcChainId Might Not Be DefinedFixed
The report gives no description here.
LowFeatures Not Validated During ShiftsFixed
The report gives no description here.
LowInability To Bridge Out During ShiftFixed
The report gives no description here.
LowIncorrect Comparison OperatorFixed
The report gives no description here.
LowIncorrect Zero Amount Check In recordBridgeInFixed
The report gives no description here.
LowInitialize FrontrunningFixed
The report gives no description here.
LowisSrcChainIdEnabledKey Can Be BypassedFixed
The report gives no description here.
LowMarketPoolValueInfo NatSpec WrongFixed
The report gives no description here.
LowmaxLendableFactor ConfigurationFixed
The report gives no description here.
LowMisleading Timelock Transaction SuccessFixed
The report gives no description here.
Show 10 more
LowMissing MAX_DATA_LENGTH InitializationFixed
The report gives no description here.
LowMissing NatSpec ParamFixed
The report gives no description here.
LowMissing nonReentrant ProtectionFixed
The report gives no description here.
LowMissing Validation For bridgeOutFromControllerFixed
The report gives no description here.
LowMisspelled Filenames In Executor ContractsFixed
The report gives no description here.
LowOld Orders Can Overwrite Newer OnesFixed
The report gives no description here.
LowRedundant WithRelayCache StructFixed
The report gives no description here.
LowUnclear Native Deposit BridgeOut ValidationFixed
The report gives no description here.
LowUnexpected Deposit Execution RevertsFixed
The report gives no description here.
LowUnfavorable Impact Withdrawal RoundingFixed
The report gives no description here.
Show 2 more
LowUnnecessary amountLD Param In recordBridgeInFixed
The report gives no description here.
LowUnnecessary TernaryFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of GMX’s security record
GMXSecurity firm
Guardian Audits15 projects reviewed · 99 reports · latest Aug 2026
See Guardian Audits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us