损失超过 4000 万美元,GMX 攻击原理分析

链捕手Published on 2025-07-10Last updated on 2025-07-10

作者:BlockSec

GMX 遭遇黑客攻击,损失超过 4000 万美元。攻击者利用了一个可重入漏洞,并在合约启用杠杆功能的情况下开空头头寸,实施了攻击。

问题的根源在于 executeDecreaseOrder 函数被错误使用。该函数的第一个参数本应是外部账户(EOA),但攻击者传入了一个智能合约地址。这使得攻击者可以在赎回过程中重新进入系统,操纵内部状态,最终赎回的资产远超过其实际持有的 GLP 价值

GLP正常赎回机制

GMX 中,GLP 是流动性提供者代币,代表对金库资产(如 USDC、ETH、WBTC)的份额。当用户调用 unstakeAndRedeemGlp 时,系统使用以下公式计算应返还的资产数量:

redeem_amount = (user_GLP / total_GLP_supply) * AUM

其中 AUM(管理资产总额)的计算方式为:

AUM = 所有 token 池的总价值 + 全局空头未实现亏损 - 全局空头未实现盈利 - 已预留金额 - 预设扣减(aumDeduction)

该机制保证了 GLP 持有者按比例获得金库的实际资产份额。

杠杆开启后的问题

enableLeverage 开启后,用户可以开设杠杆仓位(多头或空头)。攻击者在赎回 GLP 前,开设了大额的 WBTC 空头头寸。

由于空头一开仓便增加了全局空头规模,价格尚未变动的情况下系统默认该空头是亏损的,而这部分未实现亏损会被计为金库的“资产”,导致 AUM 人为上升。尽管金库并未实际获得额外价值,但赎回计算会基于这个虚高的 AUM,从而使攻击者获得了远超其应得的资产。

攻击流程

攻击交易

https://app.blocksec.com/explorer/tx/arbitrum/0x03182d3f0956a91c4e4c8f225bbc7975f9434fab042228c7acdc5ec9a32626ef?line=93

 

图片
图片

写在结尾

此次攻击暴露了 GMX 在杠杆机制与可重入保护设计上的严重缺陷。核心问题在于资产赎回逻辑对 AUM 的信任过高,未对其组成部分(如未实现亏损)进行足够审慎的安全校验。同时,关键函数对调用者身份的假设(EOA vs 合约)也缺乏强制性验证。该事件再次提醒开发者,在涉及资金敏感操作时,必须确保系统状态不可被操纵,尤其是在引入复杂金融逻辑(如杠杆、衍生品)时,更需严防重入与状态污染带来的系统性风险。

 

Trending Cryptos

Related Reads

In Conversation with Ray Dalio: We Are Currently in an AI Bubble, with 1% of My Portfolio in Bitcoin

Ray Dalio, founder of Bridgewater Associates, warns in an interview that the current AI boom shows classic bubble characteristics, which could lead to significant economic downturns as seen in past cycles like 1929 or 2000. He explains that speculative enthusiasm, fueled by debt and overvaluation, often precedes a crash when rising rates or taxation force asset sales, causing widespread losses and recession. Dalio also outlines his "Big Cycle" theory, describing an approximate 80-year pattern where widening wealth gaps, massive government deficits, and shifting geopolitical power (like China's rise) create internal conflict and global instability. He emphasizes that we are in a late-cycle, transitional phase where traditional powers like the US and UK face decline. For personal wealth protection, Dalio advises diversification beyond cash into assets like stocks, bonds, real estate, and particularly gold, which he prefers over Bitcoin. While he holds about 1% of his portfolio in Bitcoin as a non-printable hard asset, he views gold as more secure from technological or governmental threats. Regarding AI's impact, Dalio believes it will disproportionately benefit capital owners, worsening inequality by replacing both physical and cognitive labor. He suggests that human intuition and emotional intelligence, combined with AI, will be key for future workers. On taxation, Dalio argues that wealth taxes are impractical and risk triggering asset sell-offs, reducing productive investment. He points to the UK as a cautionary example of debt, low productivity, and political strife. Geopolitically, Dalio foresees a more regionalized world, with the US showing weakness in prolonged conflicts like with Iran, akin to past imperial declines. The ideal outcome, he suggests, is coexisting powerful blocs (e.g., Americas, China-Asia Pacific) without major war.

marsbit1h ago

In Conversation with Ray Dalio: We Are Currently in an AI Bubble, with 1% of My Portfolio in Bitcoin

marsbit1h ago

Daily 7.2 Trillion KRW: Foreign Capital's Record Net Buying on Friday! Wall Street Says Headwinds for Korean Stock Fund Flows Have Subsided

South Korean stock market sees a dramatic shift in fund flows. On July 31, foreign investors made a record net purchase of approximately KRW 7.2 trillion in KOSPI stocks, marking a fundamental reversal from the persistent large-scale net outflows seen in previous months. This contributed to a significant narrowing of foreign net selling in July to KRW 9.8 trillion, down sharply from KRW 48.4 trillion in June and KRW 44.5 trillion in May. Simultaneously, domestic institutional pressure eased. South Korean pension funds and asset managers turned to a net buying position in July, purchasing KRW 1.0 trillion worth of KOSPI shares, contrasting with net sales in May and June. Market volatility is expected to be dampened by new financial regulations. Effective July 31, the Financial Services Commission tightened access for retail investors to single-stock leveraged ETFs by raising the minimum cash deposit requirement. Trading volumes for these products subsequently dropped to about 50% of their monthly average. Citigroup Research maintains its year-end KOSPI target of 10,000 points. The firm cites several supportive factors: the substantial easing of headwinds from capital outflows, a robust fundamental outlook for the semiconductor sector, historically low market valuations, strong economic fundamentals, and the potential for policy support from financial authorities if needed.

marsbit1h ago

Daily 7.2 Trillion KRW: Foreign Capital's Record Net Buying on Friday! Wall Street Says Headwinds for Korean Stock Fund Flows Have Subsided

marsbit1h ago

Thanks to Dice Rolls, Bitcoin Keys Are Stored Offline, But Not Everyone Will Do It

The article discusses using dice rolls to generate secure Bitcoin wallet seeds, providing entropy independent of potentially flawed hardware random number generators. It explains that each fair dice roll offers about 2.585 bits of entropy, with around 50 rolls needed for a standard 12-word seed phrase and 99+ recommended for higher security. This method gained attention after a vulnerability was revealed in some Coldcard hardware wallets, where a faulty firmware RNG (dating back to 2021) compromised generated keys. The analysis notes that while a dice-generated main seed was safe from this specific flaw, other Coldcard functions (like creating paper wallets, backup keys, or passwords) could still be vulnerable if they used the defective RNG. The piece argues that while dice-based entropy is technically robust, the manual process is error-prone, tedious, and unrealistic for most new users, who might make mistakes in recording or inputting rolls. It concludes that while manual entropy generation should remain an option for advanced users, the long-term goal is to develop reliable, user-friendly hardware and software that securely generates randomness without requiring specialized knowledge. Coldcard users are advised to check their firmware version and replace any secondary secrets (like paper wallet keys) created with vulnerable devices, while also considering multi-signature setups with devices from different manufacturers for added security.

cryptonews.ru6h ago

Thanks to Dice Rolls, Bitcoin Keys Are Stored Offline, But Not Everyone Will Do It

cryptonews.ru6h ago

Trading

Spot

Hot Articles

How to Buy GMX

Welcome to HTX.com! We've made purchasing GMX (GMX) simple and convenient. Follow our step-by-step guide to embark on your crypto journey.Step 1: Create Your HTX AccountUse your email or phone number to sign up for a free account on HTX. Experience a hassle-free registration journey and unlock all features.Get My AccountStep 2: Go to Buy Crypto and Choose Your Payment MethodCredit/Debit Card: Use your Visa or Mastercard to buy GMX (GMX) instantly.Balance: Use funds from your HTX account balance to trade seamlessly.Third Parties: We've added popular payment methods such as Google Pay and Apple Pay to enhance convenience.P2P: Trade directly with other users on HTX.Over-the-Counter (OTC): We offer tailor-made services and competitive exchange rates for traders.Step 3: Store Your GMX (GMX)After purchasing your GMX (GMX), store it in your HTX account. Alternatively, you can send it elsewhere via blockchain transfer or use it to trade other cryptocurrencies.Step 4: Trade GMX (GMX)Easily trade GMX (GMX) on HTX's spot market. Simply access your account, select your trading pair, execute your trades, and monitor in real-time. We offer a user-friendly experience for both beginners and seasoned traders.

2.7k Total ViewsPublished 2024.03.29Updated 2026.06.02

How to Buy GMX

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of GMX (GMX) are presented below.

活动图片