DeFi Trader Nets Over $500K by Using DEX GMX to Manipulate Avalanche Token

A savvy crypto trader deployed millions of dollars to manipulate the prices of Avalanche’s AVAX tokens on the decentralized exchange GMX, taking up to $700,000 in profits by using a strategy that exploited a basic loophole.

GMX, like other decentralized exchanges, or DEXs, relies on smart contracts to match traders between decentralized finance (DeFi) users. Decentralized finance refers to trading activities carried out on a blockchain without the use of a third party.

The exchange allows users to trade spot and perpetual futures using its on-chain trading interface at low fees and has processed more than $45 billion in trading volume since its inception in 2021.

The loophole, however, is that GMX offers trading to users at zero slippage, or the difference between the expected price of a trade and the price at which the trade is executed. But all pricing data on GMX is derived from centralized exchanges, such as Binance or FTX, meaning a trader could buy a large number of tokens, such as AVAX in this case, on zero slippage, rapidly drive up prices on centralized exchanges by placing buy orders on those venues and selling the initial position on GMX at higher prices.

It’s important to note that this strategy won't work on two centralized exchanges, because a trader placing high bids on one venue would mean prices automatically move higher on that exchange and other exchanges immediately raise the price of assets on their own systems – meaning the strategy is unlikely to net any profits.

In several tweets on Sunday, Joshua Lim, head of derivatives at Genesis Global Trading, said the trader exploited the GMX loophole five times, netting over $500,000 to $700,000 in total profits. Security firm PeckShield pegged the gains at $565,000 on Sunday morning in a tweet that’s since been deleted. (Genesis and CoinDesk are both owned by Digital Currency Group.)

The trader put on positions of between $4 million to $5 million each time, Lim said, and extracted over $158,000 in the first trade he did. Lim added that this wasn’t a typical exploit as GMX worked “as designed.”

GMX developers said late Sunday that they were reviewing the loophole and had, in the meantime, capped open interest, or the number of unsettled futures contracts, at $2 million for AVAX on their exchange. A key developer said a solution can be expected in two weeks.

The price of GMX’s native token fell 12% in the past 24 hours amid a broader crypto market decline, extending the token's two-week losses to over 30%, data shows.