GMX Crosschain V2.2 1 Report
Audit · firm’s term: security review
Part of Guardian Audits’ series
Guardian Audits reviewed GMX (GMX Crosschain V2.2 1 Report) on 26 Jul 2025: 56 findings, 9 critical; 45 marked fixed, 8 acknowledged, 3 open.
Findings56
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 8 |
| High | 2 | 0 | 10 |
| Medium | 0 | 2 | 8 |
| Low | 1 | 5 | 19 |
CriticalFront-Running lzCompose Allows Fund TheftFixed
The report gives no description here.
CriticalGM Tokens Sent To MultichainVault Instead Of GLVFixed
The report gives no description here.
CriticalIncorrect Balance AccountingFixed
The report gives no description here.
CriticalIncorrect Message Decoding LeadsFixed
The report gives no description here.
CriticalMissing validatePosition After Fee DeductionFixed
The report gives no description here.
CriticalOrder Vault Drain Via Incorrect Collateral HandlingFixed
The report gives no description here.
CriticalOrder Vault Drain Via Incorrect Fee DeductionFixed
The report gives no description here.
CriticalToken Spoofing: Bridge Token X, Get Accounted For Token YFixed
The report gives no description here.
HighBypassing ValidationsFixed
The report gives no description here.
HighFunds Bridged To Wrong Chain bridgeOutFixed
The report gives no description here.
Show 10 more
HighImpact Pool Cap BypassedFixed
The report gives no description here.
HighInability To Bridge OutFixed
The report gives no description here.
HighInability To Pay Bridge Fee For bridgeOutFixed
The report gives no description here.
HighIncorrect Verification Of gasLeftFixed
The report gives no description here.
HighMissing Relay Fee Payment In Case Of bridgeOutFixed
The report gives no description here.
HighPending Impact Missing In isPositionLiquidatableFixed
The report gives no description here.
HighTransfer To EOA Instead Of Multichain BalanceFixed
The report gives no description here.
HighZero Amount Transfer Causing RevertsFixed
The report gives no description here.
MediumBridged Amount Lower Than ExpectedFixed
The report gives no description here.
MediumExecution Not Paid When Freezing OrdersFixed
The report gives no description here.
Show 10 more
MediumInability To Pay Fee From Order CollateralFixed
The report gives no description here.
MediumIncorrect Modifier In bridgeInFixed
The report gives no description here.
MediumMissing dataList Validation In GlvHandlerFixed
The report gives no description here.
MediumMissing Max Data List ValidationFixed
The report gives no description here.
MediumMissing Refund In externalCalls For MultichainFixed
The report gives no description here.
MediumMissing withOraclePricesForAtomicAction ModifierFixed
The report gives no description here.
LowAccount Receives Fee RefundsFixed
The report gives no description here.
LowBalance Decreased After TransferFixed
The report gives no description here.
LowExecution Fee Params Estimated TwiceFixed
The report gives no description here.
LowInconsistent Use Of srcChainId For EventsFixed
The report gives no description here.
Show 10 more
LowIncorrect Amount In emitMultichainBridgeOutFixed
The report gives no description here.
LowIncorrect Rounding In _getProportionalImpactPendingValuesFixed
The report gives no description here.
LowMisleading Comment For Position Fee FactorFixed
The report gives no description here.
LowMissing Event In bridgeInFixed
The report gives no description here.
LowMissing Max Fee Multiplier ValidationFixed
The report gives no description here.
LowMissing Params In NatspecFixed
The report gives no description here.
LowMultichain Balance Lost For ContractsFixed
The report gives no description here.
LowNative Tokens Not Supported In bridgeInFixed
The report gives no description here.
LowParam dataList Not Removed In WithdrawalsFixed
The report gives no description here.
LowStargate Has Limited Support For Token TransfersFixed
The report gives no description here.
Show 5 more
LowToken Permits Allowed For MultichainFixed
The report gives no description here.
LowTypo In MultichainGmRouterFixed
The report gives no description here.
LowUnnecessary baseSizeDeltaInTokens DeclarationFixed
The report gives no description here.
LowUnused _validateRange FunctionFixed
The report gives no description here.
LowWarning About Native TokensFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of GMX’s security record
GMXSecurity firm
Guardian Audits15 projects reviewed · 99 reports · latest Aug 2026
See Guardian Audits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us