DeFi Trader Nets Over $500K by Using DEX GMX to Manipulate Avalanche Token

GMX developers capped open interest for Avalanche tokens to prevent a repeat of the strategy.

AccessTimeIconSep 19, 2022 at 9:39 a.m. UTC
Updated May 11, 2023 at 6:41 p.m. UTC

A savvy crypto trader deployed millions of dollars to manipulate the prices of Avalanche’s AVAX tokens on the decentralized exchange GMX, taking up to $700,000 in profits by using a strategy that exploited a basic loophole.

GMX, like other decentralized exchanges, or DEXs, relies on smart contracts to match traders between decentralized finance (DeFi) users. Decentralized finance refers to trading activities carried out on a blockchain without the use of a third party.

The exchange allows users to trade spot and perpetual futures using its on-chain trading interface at low fees and has processed more than $45 billion in trading volume since its inception in 2021.

The loophole, however, is that GMX offers trading to users at zero slippage, or the difference between the expected price of a trade and the price at which the trade is executed. But all pricing data on GMX is derived from centralized exchanges, such as Binance or FTX, meaning a trader could buy a large number of tokens, such as AVAX in this case, on zero slippage, rapidly drive up prices on centralized exchanges by placing buy orders on those venues and selling the initial position on GMX at higher prices.

It’s important to note that this strategy won't work on two centralized exchanges, because a trader placing high bids on one venue would mean prices automatically move higher on that exchange and other exchanges immediately raise the price of assets on their own systems – meaning the strategy is unlikely to net any profits.

In several tweets on Sunday, Joshua Lim, head of derivatives at Genesis Global Trading, said the trader exploited the GMX loophole five times, netting over $500,000 to $700,000 in total profits. Security firm PeckShield pegged the gains at $565,000 on Sunday morning in a tweet that’s since been deleted. (Genesis and CoinDesk are both owned by Digital Currency Group.)

The trader put on positions of between $4 million to $5 million each time, Lim said, and extracted over $158,000 in the first trade he did. Lim added that this wasn’t a typical exploit as GMX worked “as designed.”

GMX developers said late Sunday that they were reviewing the loophole and had, in the meantime, capped open interest, or the number of unsettled futures contracts, at $2 million for AVAX on their exchange. A key developer said a solution can be expected in two weeks.

The price of GMX’s native token fell 12% in the past 24 hours amid a broader crypto market decline, extending the token's two-week losses to over 30%, data shows.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.

Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.