If you notice some outdated information please let us know!
Process Quality Review (0.8)
GMX V1
PASS
Scoring Appendix
The final review score is indicated as a percentage. The percentage is calculated as Achieved Points due to MAX Possible Points. For each element the answer can be either Yes/No or a percentage. For a detailed breakdown of the individual weights of each question, please consult this document.
Very simply, the audit looks for the following declarations from the developer's site. With these declarations, it is reasonable to trust the smart contracts.
- Here is my smart contract on the blockchain
- You can see it matches a software repository used to develop the code
- Here is the documentation that explains what my smart contract does
- Here are the tests I ran to verify my smart contract
- Here are the audit(s) performed to review my code by third party experts
This report is for informational purposes only and does not constitute investment advice of any kind, nor does it constitute an offer to provide investment advisory or other services. Nothing in this report shall be considered a solicitation or offer to buy or sell any security, token, future, option or other financial instrument or to offer or provide any investment advice or service to any person in any jurisdiction. Nothing contained in this report constitutes investment advice or offers any opinion with respect to the suitability of any security, and the views expressed in this report should not be taken as advice to buy, sell or hold any security. The information in this report should not be relied upon for the purpose of investing. In preparing the information contained in this report, we have not taken into account the investment needs, objectives and financial circumstances of any particular investor. This information has no regard to the specific investment objectives, financial situation and particular needs of any specific recipient of this information and investments discussed may not be suitable for all investors.
Any views expressed in this report by us were prepared based upon the information available to us at the time such views were written. The views expressed within this report are limited to DeFiSafety and the author and do not reflect those of any additional or third party and are strictly based upon DeFiSafety, its authors, interpretations and evaluation of relevant data. Changed or additional information could cause such views to change. All information is subject to possible correction. Information may quickly become unreliable for various reasons, including changes in market conditions or economic circumstances.
This completed report is copyright (c) DeFiSafety 2023. Permission is given to copy in whole, retaining this copyright label.
Smart Contracts & Team
78%
This section looks at the code deployed on the relevant chain that gets reviewed and its corresponding software repository. The document explaining these questions is here.
1. Are the smart contract addresses easy to find? (%)
GMX's smart contract addresses can be found at https://gmxio.gitbook.io/gmx/contracts, as indicated in the Appendix.
2. How active is the primary contract? (%)
3. Does the protocol have a public software repository? (Y/N)
Location: https://github.com/gmx-io/gmx-contracts
4. Is there a development history visible? (%)
With 220 commits and 7 branches, GMX's main software repository is robustly developed.
5. Is the team public (not anonymous)?
GMX is run by anonymous developers.
Documentation
79%
This section looks at the software documentation. The document explaining these questions is here.
6. Is there a whitepaper? (Y/N)
Location: https://gmxio.gitbook.io/gmx/
7. Is the protocol's software architecture documented? (Y/N)
GMX documents their general software architecture here.
8. Does the software documentation fully cover the deployed contracts' source code? (%)
9. Is it possible to trace the documented software to its implementation in the protocol's source code? (%)
GMX links every core smart contract to their respective source code locations in their GitHub. This can be seen in their Notion docs.
Testing
70%
10. Has the protocol tested their deployed code? (%)
Code examples are in the Appendix at the end of this report.. As per the SLOC, there is 174% testing to code (TtC). This score is guided by the Test to Code ratio (TtC). Generally a good test to code ratio is over 100%. However, the reviewer's best judgement is the final deciding factor.
11. How covered is the protocol's code? (%)
Although GMX does not have a public code coverage report, they certainly have a very in-depth testing suite.
12. Does the protocol provide scripts and instructions to run their tests? (Y/N)
Scripts/Instructions location: https://github.com/gmx-io/gmx-contracts/tree/master/scripts
13. Is there a detailed report of the protocol's test results?(%)
There is no visible test result report in any of GMX's documentation or GitHub repositories.
14. Has the protocol undergone Formal Verification? (Y/N)
GMX has not undergone a Formal Verification test.
15. Were the smart contracts deployed to a testnet? (Y/N)
GMX documents their previous testnet deployments here.
Security
91%
This section looks at the 3rd party software audits done. It is explained in this document.
16. Is the protocol sufficiently audited? (%)
17. Is the bounty value acceptably high (%)
GMX offers an active bug bounty of $5m.
Admin Controls
89%
This section covers the documentation of special access controls for a DeFi protocol. The admin access controls are the contracts that allow updating contracts or coefficients in the protocol. Since these contracts can allow the protocol admins to "change the rules", complete disclosure of capabilities is vital for user's transparency. It is explained in this document.
18. Is the protocol's admin control information easy to find?
GMX details their admin control information at this location, which took a bit of searching since it does not reside in their main gitbooks repository, and is instead linked from it.
19. Are relevant contracts clearly labelled as upgradeable or immutable? (%)
GMX clearly mentions that the logic of their contracts is immutable, but peripheral functions such as fees and pricing calculations can be updated. As such, GMX contracts inherently do not possess an upgradeable structure. - "The core logic of the GMX contracts cannot be changed, but certain peripheral functions such as fee and pricing calculations can be updated. This update is done by implementing new fee / pricing contracts and updating the core contracts to use the new contracts. For example, the Vault contract has a priceFeed value that can be changed by the Timelock contract described in the Access Control section".
20. Is the type of smart contract ownership clearly indicated? (%)
GMX contracts are controlled by a controlled account owned by the team. In addition, there is a Multisig consisting of advisors and community members. This multisig is composed of: - Ben Simon - Han Wen - Krunal Amin
21. Are the protocol's smart contract change capabilities described? (%)
GMX identifies all parameters that they can change/upgrade, and to what extent:
- Setting of swap and margin trading fees up to a maximum of 5%
- Setting of token weights for the GLP pool, token weights affect the dynamic fees of swaps, these fees are such that a swap which increases the balance towards the specified token weight will be lower, while a swap that moves the token weight away from the desired amounts will have higher fees, the details of the calculation can be found from Vault.vaultUtils.getSwapFeeBasisPoints - Pausing of swaps or leverage trading for emergency use - Setting of the maximum allowed leverage - Setting of maximum total capacity for long and short positions Additional timelock parameters include: - Listing of new tokens - UpdatingVault.priceFeed - UpdatingVault.vaultUtils, the VaultUtils contract validates the opening and closing of positions and also specifies how fees are calculated - Updating of gov` values
22. Is the protocol's admin control information easy to understand? (%)
Along with a clear explanation about the contracts' core logic being immutable, GMX details that any malicious transaction is sent, it is theoretically possible for a draining of all user funds to occur. However, any transaction that can enable this must pass through a rigorous process of internal verification, which leaves a lot of room for finding and mitigating such an event. GMX details this in clear, user friendly language: - "In the event of a malicious transaction being sent, it is possible for all funds in the pool to be compromised. To mitigate this, all actions which can impact user funds must pass through the signal, time gap, execute process mentioned above. If a malicious transactions is detected through the monitoring process or Bug Bounty, a multi-sig consisting of advisors and community members can be used to override the Timelock.admin value, this would prevent the action from being executed. This also applies for actions such as pausing trading when there was no need to, in this case, the admin can be replaced by the multi-sig and trading can be re-activated".
23. Is there sufficient Pause Control documentation? (%)
GMX clearly explains that their pause function can be used to halt swapping or leverage trading.
24. Is there sufficient Timelock documentation? (%)
GMX identifies the use and the lock period of a Timelock for its GMX contract here. Additional Timelock documentation relating to the team's admin powers can be found in their Notion docs.
25. Is the Timelock of an adequate length? (Y/N)
GMX's timelock has a duration of 28 days for token supply upgrades. GMX's additional timelock docs identify a 24 hour timelock for anything upgrade-related. GMX mentions that 24h was selected for this subsequent timelock as it allows them to "respond quickly to any issues that may occur".
Oracles
100%
This section goes over the documentation that a protocol may or may not supply about their Oracle usage. Oracles are a fundamental part of DeFi as they are responsible for relaying tons of price data information to thousands of protocols using blockchain technology. Not only are they important for price feeds, but they are also an essential component of transaction verification and security. These questions are explained in this document.
26. Is the protocol's Oracle sufficiently documented? (%)
GMX briefly mentions the use of Chainlink and TWAP oracles here. In addition, GMX fully breaks down their price feed architecture in their notion docs.
27. Is front running mitigated by this protocol? (Y/N)
GMX mitigates front running attacks "through the two step transaction process, swap fees and KeeperDAO integration covered in the "Router" section". This information is documented in the GMX Notion docs.
28. Can flashloan attacks be applied to the protocol, and if so, are those flashloan attack risks mitigated? (Y/N)
GMX outlines their flash loan exploit mitigation/prevention strategy in their Notion docs. - "Opening and closing of positions as well as swaps, minting and redeeming of GLP are settled at the oracle price covered in the Price Feeds section since these prices are not dependent on pool composition or parameters like long / short ratios, so a flash loan would not have an impact on these functions. The dynamic fees for swaps are dependent on pool composition, however, this does not lead to positive slippage so the maximum benefit from a flash loan would be a zero fee swap which adjusts pool composition towards the desired token weights".
Appendices
1contract Vault is ReentrancyGuard, IVault {
2 using SafeMath for uint256;
3 using SafeERC20 for IERC20;
4
5 struct Position {
6 uint256 size;
7 uint256 collateral;
8 uint256 averagePrice;
9 uint256 entryFundingRate;
10 uint256 reserveAmount;
11 int256 realisedPnl;
12 uint256 lastIncreasedTime;
13 }
14
15 uint256 public constant BASIS_POINTS_DIVISOR = 10000;
16 uint256 public constant FUNDING_RATE_PRECISION = 1000000;
17 uint256 public constant PRICE_PRECISION = 10 ** 30;
18 uint256 public constant MIN_LEVERAGE = 10000; // 1x
19 uint256 public constant USDG_DECIMALS = 18;
20 uint256 public constant MAX_FEE_BASIS_POINTS = 500; // 5%
21 uint256 public constant MAX_LIQUIDATION_FEE_USD = 100 * PRICE_PRECISION; // 100 USD
22 uint256 public constant MIN_FUNDING_RATE_INTERVAL = 1 hours;
23 uint256 public constant MAX_FUNDING_RATE_FACTOR = 10000; // 1%
24
25 bool public override isInitialized;
26 bool public override isSwapEnabled = true;
27 bool public override isLeverageEnabled = true;
28
29 IVaultUtils public vaultUtils;
30
31 address public errorController;
32
33 address public override router;
34 address public override priceFeed;
35
36 address public override usdg;
37 address public override gov;
38
39 uint256 public override whitelistedTokenCount;
40
41 uint256 public override maxLeverage = 50 * 10000; // 50x
42
43 uint256 public override liquidationFeeUsd;
44 uint256 public override taxBasisPoints = 50; // 0.5%
45 uint256 public override stableTaxBasisPoints = 20; // 0.2%
46 uint256 public override mintBurnFeeBasisPoints = 30; // 0.3%
47 uint256 public override swapFeeBasisPoints = 30; // 0.3%
48 uint256 public override stableSwapFeeBasisPoints = 4; // 0.04%
49 uint256 public override marginFeeBasisPoints = 10; // 0.1%
50
51 uint256 public override minProfitTime;
52 bool public override hasDynamicFees = false;
53
54 uint256 public override fundingInterval = 8 hours;
55 uint256 public override fundingRateFactor;
56 uint256 public override stableFundingRateFactor;
57 uint256 public override totalTokenWeights;
58
59 bool public includeAmmPrice = true;
60 bool public useSwapPricing = false;
61
62 bool public override inManagerMode = false;
63 bool public override inPrivateLiquidationMode = false;
64
65 uint256 public override maxGasPrice;
66
67 mapping (address => mapping (address => bool)) public override approvedRouters;
68 mapping (address => bool) public override isLiquidator;
69 mapping (address => bool) public override isManager;
70
71 address[] public override allWhitelistedTokens;
72
73 mapping (address => bool) public override whitelistedTokens;
74 mapping (address => uint256) public override tokenDecimals;
75 mapping (address => uint256) public override minProfitBasisPoints;
76 mapping (address => bool) public override stableTokens;
77 mapping (address => bool) public override shortableTokens;
78
79 // tokenBalances is used only to determine _transferIn values
80 mapping (address => uint256) public override tokenBalances;
81
82 // tokenWeights allows customisation of index composition
83 mapping (address => uint256) public override tokenWeights;
84
85 // usdgAmounts tracks the amount of USDG debt for each whitelisted token
86 mapping (address => uint256) public override usdgAmounts;
87
88 // maxUsdgAmounts allows setting a max amount of USDG debt for a token
89 mapping (address => uint256) public override maxUsdgAmounts;
90
91 // poolAmounts tracks the number of received tokens that can be used for leverage
92 // this is tracked separately from tokenBalances to exclude funds that are deposited as margin collateral
93 mapping (address => uint256) public override poolAmounts;
94
95 // reservedAmounts tracks the number of tokens reserved for open leverage positions
96 mapping (address => uint256) public override reservedAmounts;
97
98 // bufferAmounts allows specification of an amount to exclude from swaps
99 // this can be used to ensure a certain amount of liquidity is available for leverage positions
100 mapping (address => uint256) public override bufferAmounts;
101
102 // guaranteedUsd tracks the amount of USD that is "guaranteed" by opened leverage positions
103 // this value is used to calculate the redemption values for selling of USDG
104 // this is an estimated amount, it is possible for the actual guaranteed value to be lower
105 // in the case of sudden price decreases, the guaranteed value should be corrected
106 // after liquidations are carried out
107 mapping (address => uint256) public override guaranteedUsd;
108
109 // cumulativeFundingRates tracks the funding rates based on utilization
110 mapping (address => uint256) public override cumulativeFundingRates;
111 // lastFundingTimes tracks the last time funding was updated for a token
112 mapping (address => uint256) public override lastFundingTimes;
113
114 // positions tracks all open positions
115 mapping (bytes32 => Position) public positions;
116
117 // feeReserves tracks the amount of fees per token
118 mapping (address => uint256) public override feeReserves;
119
120 mapping (address => uint256) public override globalShortSizes;
121 mapping (address => uint256) public override globalShortAveragePrices;
122 mapping (address => uint256) public override maxGlobalShortSizes;
123
124 mapping (uint256 => string) public errors;
125
126 event BuyUSDG(address account, address token, uint256 tokenAmount, uint256 usdgAmount, uint256 feeBasisPoints);
127 event SellUSDG(address account, address token, uint256 usdgAmount, uint256 tokenAmount, uint256 feeBasisPoints);
128 event Swap(address account, address tokenIn, address tokenOut, uint256 amountIn, uint256 amountOut, uint256 amountOutAfterFees, uint256 feeBasisPoints);
129
JavaScript Tests
Tests to Code: 14335 / 8239 = 174 %