{"id":1085,"date":"2025-07-22T13:26:41","date_gmt":"2025-07-22T11:26:41","guid":{"rendered":"https:\/\/ackee.xyz\/blog\/?p=1085"},"modified":"2025-08-04T16:46:24","modified_gmt":"2025-08-04T14:46:24","slug":"gmx-hack-analysis-attack-scenarios-with-wake","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/gmx-hack-analysis-attack-scenarios-with-wake\/","title":{"rendered":"GMX Hack Analysis & Attack Scenarios with Wake"},"content":{"rendered":"

This analysis examines the\u00a042M attack on the GMX protocol<\/a>. We provide a detailed technical breakdown of the vulnerability and include a working reproduction of the attack scenario for educational purposes in a forked environment.<\/p>\n

The attack exploited a\u00a0cross-contract reentrancy vulnerability<\/strong>\u00a0that bypassed access controls during position increases. This resulted in GLP token price manipulation with a higher price, allowing attackers to redeem tokens at the manipulated price and extract profits from the protocol.<\/p>\n

\"wake<\/p>\n

Reproducing with Wake<\/h2>\n
    \n
  1. Clone the\u00a0repository<\/a><\/li>\n
  2. Import GMX project dependencies:
    \n$ npm i<\/code><\/li>\n
  3. Initialise Wake:
    \n$ wake up<\/code><\/li>\n
  4. Get an Arbitrum fork URL from Alchemy or other providers and set it in\u00a0.env<\/code>\u00a0similar to\u00a0.env.example<\/code>.<\/li>\n
  5. Run the test:
    \n$ wake test tests\/test_attack_simple.py<\/code><\/li>\n
  6. Uncomment\u00a0print(tx.call_trace)<\/code>\u00a0to see the call trace.<\/li>\n<\/ol>\n

    Root cause<\/h2>\n

    The vulnerability stems from a reentrancy issue. While the reentrancy itself is straightforward, its impact is significant.<\/p>\n

    The core issue: GLP token price calculation relies on the\u00a0globalShortAveragePrices<\/code>\u00a0variable from\u00a0ShortsTracker<\/code>. This dependency creates an exploitable attack vector.<\/p>\n

    The vulnerability is cross-contract reentrancy. Multiple contracts were involved during the transaction. Each contract has a reentrancy guard; however, reentrancy occurred after it had already exited for one specific contract.<\/p>\n

    \n
    For a detailed explanation of cross-contract reentrancy, see\u00a0this comprehensive guide<\/a>.<\/div>\n<\/div>\n

    Entry point<\/h2>\n

    The attack begins when a user increases their position:<\/p>\n

      \n
    1. User calls\u00a0createIncreaseOrder<\/code>\u00a0to register the order<\/li>\n
    2. The orderkeeper bot calls\u00a0PositionManager.executeIncreaseOrder<\/code>\u00a0to execute it<\/li>\n
    3. Within\u00a0executeIncreaseOrder<\/code>,\u00a0ShortsTracker.updateGlobalShortData<\/code>\u00a0is invoked<\/li>\n<\/ol>\n

      ShortsTracker.updateGlobalShortData<\/code>\u00a0stores the\u00a0globalShortAveragePrice<\/code>\u00a0for the token \u2014 the average entry price of all short positions. This value directly influences GLP token price calculations.<\/p>\n

      contract PositionManager {\n    function executeIncreaseOrder(\n        address _account,\n        uint256 _orderIndex,\n        address payable _feeReceiver\n    ) external onlyOrderKeeper {\n        \/\/...\n        IShortsTracker(shortsTracker).updateGlobalShortData(_account, collateralToken, indexToken, isLong, sizeDelta, markPrice, true);\n        ITimelock(timelock).enableLeverage(_vault); \/\/ isLeverageEnabled <- True\n        IOrderBook(orderBook).executeIncreaseOrder(_account, _orderIndex, _feeReceiver);\n        ITimelock(timelock).disableLeverage(_vault); \/\/ isLeverageEnabled <- False\n        _emitDecreasePositionReferral(_account, sizeDelta);\n    }\n}<\/code><\/pre>\n
      External calls follow this path to reach the\u00a0Vault<\/code>:<\/p>\n
        \n
      • OrderBook.executeIncreaseOrder<\/code>\n
          \n
        • Router.pluginIncreasePosition<\/code>\n
            \n
          • Vault.increasePosition<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
            The\u00a0decreasePosition<\/code>\u00a0flow follows a similar pattern.<\/p>\n
            The\u00a0Vault.increasePosition<\/code>\u00a0function checks that\u00a0isLeverageEnabled<\/code>\u00a0equals\u00a0True<\/code>\u00a0to verify that the call occurs between\u00a0Timelock.enableLeverage<\/code>\u00a0and\u00a0Timelock.disableLeverage<\/code>. This check proved insufficient.<\/p>\n
            contract Vault {\n    \/\/ function has no msg.sender check.\n    \/\/ Assumes caller transfers tokens or at least the caller is trusted.\n    function increasePosition(\n        address _account,\n        address _collateralToken,\n        address _indexToken,\n        uint256 _sizeDelta,\n        bool _isLong\n    ) external override nonReentrant {\n        _validate(isLeverageEnabled, 28); \/\/ this will be bypassed\n        _validateGasPrice();\n        _validateRouter(_account);\n        ...\n        ...\n    }\n}<\/code><\/pre>\n
            During\u00a0Vault.decreasePosition<\/code>, the contract transfers collateral tokens for closed positions. When the collateral token is WETH, the system withdraws ETH and transfers it to the user\u2019s account. Notably, these WETH operations occur outside the\u00a0Vault<\/code>\u00a0contract.<\/p>\n
            The call flow proceeds as follows:<\/p>\n
              \n
            • OrderBook.executeDecreaseOrder<\/code>\n
                \n
              • Router.pluginDecreasePosition<\/code>\n
                  \n
                • Vault.decreasePosition<\/code>\n
                    \n
                  1. ReentrancyGuard set to\u00a0ENTERED<\/code><\/li>\n
                  2. Vault<\/code>\u00a0closes position<\/li>\n
                  3. Sends WETH to OrderBook<\/li>\n
                  4. ReentrancyGuard set to\u00a0NOT_ENTERED<\/code><\/li>\n<\/ol>\n<\/li>\n<\/ul>\n<\/li>\n
                  5. OrderBook<\/code>\u00a0withdraws ETH<\/li>\n
                  6. Transfers ETH to user\n
                      \n
                    • User.receive<\/code>\u00a0is triggered\n
                        \n
                      • Vault.increasePosition<\/code>\u00a0(exploit)\n
                          \n
                        1. ReentrancyGuard confirms\u00a0NOT_ENTERED<\/code><\/li>\n
                        2. ReentrancyGuard is set to\u00a0ENTERED<\/code><\/li>\n
                        3. Attack continues\u2026<\/li>\n<\/ol>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                          The reentrancy guard in\u00a0Vault<\/code>\u00a0starts as\u00a0NOT_ENTERED<\/code>, but the reentrant call occurs after this status has been reset, bypassing the protection.<\/p>\n
                          Attack escalation<\/h2>\n
                          The direct\u00a0Vault.increasePosition<\/code>\u00a0call bypasses\u00a0ShortsTracker.updateGlobalShortData<\/code>, causing\u00a0GlpManager.getAum<\/code>\u00a0to return inflated values and artificially increase the GLP token price.<\/p>\n
                          Attack sequence:<\/p>\n
                            \n
                          1. Re-enter through the open entry point<\/li>\n
                          2. Add liquidity to obtain GLP tokens<\/li>\n
                          3. Call\u00a0increasePosition<\/code>\u00a0to manipulate the GLP token price upward<\/li>\n
                          4. Remove liquidity at the inflated GLP token price<\/li>\n<\/ol>\n
                            Operational details<\/h2>\n
                            The attacker uses\u00a0RewardRouterV2.mintAndStakeGlp<\/code>\u00a0because\u00a0GLPManager.inPrivateMode<\/code>\u00a0is enabled, preventing direct calls to\u00a0GLPManager.addLiquidity<\/code>.<\/p>\n
                            The attacker used a flash loan with USDC in fallback function to create a large WBTC short position.<\/p>\n
                            Summary<\/h2>\n
                            The attack succeeded due to fragmented data responsibility across contracts. Critical state information was split between\u00a0ShortsTracker<\/code>\u00a0and\u00a0Vault<\/code>, rendering the reentrancy guard ineffective. This architectural vulnerability allowed attackers to manipulate GLP token prices through carefully orchestrated re-entrant calls, enabling the multimillion exploit.<\/p>\n","protected":false},"excerpt":{"rendered":"
                            This analysis examines the\u00a042M attack on the GMX protocol. We provide a detailed technical breakdown of the vulnerability and include a working reproduction of the attack scenario for educational purposes in a forked environment. The attack exploited a\u00a0cross-contract reentrancy vulnerability\u00a0that bypassed access controls during position increases. This resulted in GLP token price manipulation with a higher price, allowing attackers to redeem tokens…<\/p>\n","protected":false},"author":24,"featured_media":1036,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[61,10,85,84,80,63,103],"tags":[96,24,33,14,64,28,104],"class_list":["post-1085","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education","category-ethereum","category-exploits","category-hacks","category-solidity","category-tutorial","category-wake","tag-educational","tag-ethereum","tag-evm","tag-exploit","tag-security","tag-smart-contract","tag-wake"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2025\/04\/Flash-Loan-Reentrancy-Attack-1-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2025\/04\/Flash-Loan-Reentrancy-Attack-1-600x600.png","author_info":{"display_name":"Naoki Yoshida","author_link":"https:\/\/ackee.xyz\/blog\/author\/naoki-yoshida\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/1085","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=1085"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/1085\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/1036"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=1085"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=1085"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=1085"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}