GMX Crosschain V2.2 2 Report
Audit · firm’s term: security review
Part of Guardian Audits’ series
Guardian Audits reviewed GMX (GMX Crosschain V2.2 2 Report) on 26 Jul 2025: 45 findings, 2 critical; 35 marked fixed, 10 acknowledged.
Findings45
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 5 |
| Medium | 0 | 4 | 9 |
| Low | 0 | 6 | 19 |
CriticalInconsistent AccountingFixed
The report gives no description here.
CriticalMissing ValidationsFixed
The report gives no description here.
HighMissing Expo In messageHashFixed
The report gives no description here.
HighPosition Validated With Atomic OraclesFixed
The report gives no description here.
HighPrice Impact Not GuaranteedFixed
The report gives no description here.
HighTransfer To EOA Instead Of Multichain BalanceFixed
The report gives no description here.
HighUncapped Positive Impact In Liquidation CheckFixed
The report gives no description here.
MediumCollateral MismatchFixed
The report gives no description here.
MediumEarly Validation Allows Inconsistent Market StateFixed
The report gives no description here.
MediumIncorrect Balance Check In bridgeOutFixed
The report gives no description here.
Show 10 more
MediumIntegration Id Not Validated For Gasless RoutersFixed
The report gives no description here.
MediumMissing validateSequencerUpFixed
The report gives no description here.
MediumMissing validateSequencerUp In Impact PoolFixed
The report gives no description here.
MediumNonce Always IncreasedFixed
The report gives no description here.
MediumStale Funding State UsedFixed
The report gives no description here.
MediumvalidatePosition Might DoS Valid ActionsFixed
The report gives no description here.
LowBridge Out Same Chain Requires Two TransfersFixed
The report gives no description here.
LowBridged Funds Can Be Lost Or TrappedFixed
The report gives no description here.
LowInconsistent ValidationFixed
The report gives no description here.
LowIncorrect Gas Tracking For RelayFixed
The report gives no description here.
Show 10 more
LowIncorrect recordTransferIn UsageFixed
The report gives no description here.
LowLiquidation Optimization createLiquidationFixed
The report gives no description here.
LowMisleading Comment For Bridge Out FeeFixed
The report gives no description here.
LowMissing Feature Flag ValidationFixed
The report gives no description here.
LowMissing SafeguardsFixed
The report gives no description here.
LowModifier Execution OrderFixed
The report gives no description here.
LowOld Orders Can Overwrite Newer OnesFixed
The report gives no description here.
LowPrecision Loss For Token WithdrawalFixed
The report gives no description here.
LowRisk Free Trade By Causing RevertsFixed
The report gives no description here.
LowtransferOut Perturbs Multichain AccountingFixed
The report gives no description here.
Show 5 more
LowUnnecessary Approval For WNT When BridgingFixed
The report gives no description here.
LowUnnecessary srcChainId In bridgeInFixed
The report gives no description here.
LowUntrusted srcChainIdFixed
The report gives no description here.
LowUnused Cache Struct ParamFixed
The report gives no description here.
LowValidate Receiver In batchClaimAffiliateRewardsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of GMX’s security record
GMXSecurity firm
Guardian Audits15 projects reviewed · 99 reports · latest Aug 2026
See Guardian Audits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us