GMX

Summary

GMX is a decentralized perpetual-futures and spot exchange that launched on Arbitrum on September 1, 2021 (GLP minting; GMX token trading followed on September 6) and expanded to Avalanche on January 5, 2022. Built by a pseudonymous team — the lead developer is known as "X" — that had previously shipped XVIX and Gambit, GMX replaced the orderbook and the vAMM (Perpetual Protocol's approach) with a third model: traders take leveraged positions of up to ~50x (later up to 100x) priced directly from oracles, against a single pooled counterparty of passive liquidity providers. That pool, GLP, was an index basket of blue-chip assets (ETH, BTC, stablecoins, etc.) whose holders collectively took the other side of every trade and earned the majority of protocol fees (70% under V1). GMX's fee-sharing staking model made it the flagship of the 2022 "real yield" narrative, and it became the anchor application of Arbitrum DeFi. A V2 (mid-2023) replaced the shared GLP pool with isolated per-market GM pools; in July 2025 the deprecated V1 was exploited for roughly $40–42M, most of which was returned under a white-hat bounty, with GMX completing a ~$44M compensation plan for affected GLP holders. GMX remains live (TVL around $150M as of mid-2026), a diminished but durable protocol relative to its 2022 peak.

Design (Mechanism)

• Oracle pricing, no orderbook. Positions open and close at oracle-reported prices (Chainlink, plus a keeper-fed fast-price mechanism in V1; Chainlink Data Streams in V2). This gives "zero price impact" trades — a large order fills at the index price — eliminating slippage but making the protocol's solvency entirely dependent on oracle integrity and latency.
• GLP: the pooled counterparty. LPs mint GLP by depositing any index asset. GLP is simultaneously the swap liquidity, the trader collateral pool, and the house: trader losses accrue to GLP, trader profits are paid out of it. GLP price = (pool AUM ± trader PnL) / supply. LPs earned 70% of all fees (swap, margin, borrow, liquidation), paid in ETH/AVAX.
• GMX token: fee-sharing governance. Staked GMX earned 30% of protocol fees in ETH/AVAX plus escrowed GMX (esGMX, vesting emissions) and Multiplier Points, a loyalty mechanism boosting fee share for long-term stakers — "real yield" from actual revenue rather than pure inflation.
• Funding replaced by borrow fees. Instead of longs-pay-shorts funding, both sides paid a utilization-based borrow fee to GLP, simplifying the model but leaving open-interest imbalance risk with LPs.
• V2 (GM pools, mid-2023). Isolated markets, each with its own long/short/stable collateral pool (GM), funding fees between longs and shorts, price-impact and open-interest caps to resist manipulation, and GLV aggregated vaults layered on top. Fee split to LPs adjusted (currently 63% on Arbitrum/Avalanche per docs).

Outcome

Partial success. GMX was the breakout application of Arbitrum's first years: billions in monthly volume, GLP TVL in the hundreds of millions (peaking above ~$500M during 2022), and cumulative fees in the hundreds of millions of dollars distributed to token stakers and LPs — one of the few DeFi protocols whose token cash flows were real rather than inflationary. It spawned an entire ecosystem of "GLP wrappers" and dozens of forks. It also absorbed hard lessons: a September 2022 AVAX price-manipulation episode showed zero-slippage oracle pricing could be gamed on thin-liquidity assets (motivating V2's price-impact and OI caps), and on July 9, 2025 the deprecated V1 GLP pool on Arbitrum was drained of ~$40–42M via a re-entrancy flaw that let the attacker manipulate GLP's AUM calculation and mint unbacked GLP. About $37.5M was returned after GMX offered a 10% ($4.2M) white-hat bounty, and GMX finalized a ~$44M GLV-denominated compensation plan for affected GLP holders. GMX V2 continues operating across Arbitrum and Avalanche (TVL ~$150M, mid-2026), no longer dominant — Hyperliquid and newer perp venues captured the category's growth — but solvent, shipping, and governed by its DAO.

Why it worked

• LP UX radically simpler than orderbooks. One index token, passive exposure, fees in ETH — GLP made market-making a deposit button, bootstrapping deep liquidity no on-chain orderbook of the era could match.
• Zero price impact was a genuine trader draw for large positions on majors, and oracle pricing sidestepped the latency limits of 2021-era L2 blockspace.
• Real-yield tokenomics built a loyal holder base. Paying stakers in ETH from actual revenue, with esGMX and multiplier points rewarding patience, stood out starkly during the 2022 collapse of emissions-farming DeFi.
• Right chain, right time. Launching days after Arbitrum One opened made GMX the L2's anchor app, with the ecosystem (and later ARB incentives) compounding around it.
• Credible pseudonymous shipping. The XVIX/Gambit lineage meant the anonymous team had a track record, and consistent delivery plus multiple audits sustained trust.

Where the design broke

• The house-pool model concentrates tail risk on LPs. GLP holders were short every trader's PnL with no isolation; a skilled or manipulative trader (AVAX incident, 2022) drains LPs directly.
• Zero-slippage oracle pricing is an exploit surface. It imports CEX prices without importing CEX depth, enabling manipulation on thinner assets — the core reason V2 added price impact and OI caps.
• Deprecated code kept custody of live funds. The 2025 exploit hit V1, years after V2 launched; winding down without force-migrating liquidity left ~$40M exposed to a latent re-entrancy bug despite numerous audits.
• Competitive erosion. V2's isolated pools fixed V1's flaws but arrived as faster app-chain perps (notably Hyperliquid) reset trader expectations on latency and listing breadth; GMX lost category leadership.
• Incentive complexity. esGMX vesting and multiplier points created lock-in but also a convoluted, hard-to-value rewards system that governance later spent significant effort simplifying.

Lessons

• A pooled counterparty converts trader edge into LP loss; caps and isolation are not optional. Any "house pool" design needs open-interest limits, price-impact curves, and per-market isolation from day one, not as a V2 retrofit.
• Oracle-priced execution means your solvency is only as good as your oracle path — latency, thin-market manipulation, and the price-computation code (GLP's AUM math) are all part of the attack surface, not just the feed.
• "Real yield" is a durable moat. Distributing genuine fee revenue in a hard asset created holder loyalty that outlasted the emissions-farming cohort of 2021–22 and remains GMX's most-copied innovation.
• Deprecation is a security operation. Old versions holding user funds must be actively wound down (withdrawal-only mode, migration incentives, reduced caps); "legacy" contracts with nine figures of TVL are a standing bounty.
• Rapid, well-structured incident response preserves protocols. The 48-hour 10% bounty offer, recovery of ~$37.5M, and a funded compensation plan let GMX survive an exploit that has killed comparable protocols.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial analysis — a hypothesis, not established fact. A redesigned GMX would keep the two genuinely great ideas — passive pooled liquidity and fee-denominated real yield — while treating V1's uniform trust assumptions as the core flaw. First, make risk tiering explicit: a senior GLP-like tranche capped at conservative OI against majors only, and junior per-market tranches (essentially V2's GM pools) that absorb manipulation-prone long-tail listings, with LPs pricing that risk via differentiated fee shares. Second, treat oracle execution as adversarial by default: two independent price paths with a divergence circuit breaker, execution delays scaled to a market's off-chain depth, and AUM/pricing functions guarded by global re-entrancy locks and invariant checks (GLP supply vs. verified collateral) that halt minting on violation — the exact invariant the 2025 attacker broke. Third, encode sunset policy in governance: any deprecated version automatically enters withdrawal-only mode with decaying fee rewards after N months, so legacy TVL trends to zero instead of lingering as a target. Finally, simplify token incentives to a single staked-GMX fee stream with time-weighted boosts, dropping the esGMX/multiplier-point apparatus whose complexity bought retention at the cost of legibility. The hypothesis: GMX's category loss to app-chain perps was less about latency than about trust overhead — a version with provable risk isolation and automated wind-downs could have defended the "passive LP" niche that orderbook venues still cannot serve.