损失超过 4000 万美元,GMX 攻击原理分析

链捕手Publicado a 2025-07-10Actualizado a 2025-07-10

作者:BlockSec

GMX 遭遇黑客攻击,损失超过 4000 万美元。攻击者利用了一个可重入漏洞,并在合约启用杠杆功能的情况下开空头头寸,实施了攻击。

问题的根源在于 executeDecreaseOrder 函数被错误使用。该函数的第一个参数本应是外部账户(EOA),但攻击者传入了一个智能合约地址。这使得攻击者可以在赎回过程中重新进入系统,操纵内部状态,最终赎回的资产远超过其实际持有的 GLP 价值

GLP正常赎回机制

GMX 中,GLP 是流动性提供者代币,代表对金库资产(如 USDC、ETH、WBTC)的份额。当用户调用 unstakeAndRedeemGlp 时,系统使用以下公式计算应返还的资产数量:

redeem_amount = (user_GLP / total_GLP_supply) * AUM

其中 AUM(管理资产总额)的计算方式为:

AUM = 所有 token 池的总价值 + 全局空头未实现亏损 - 全局空头未实现盈利 - 已预留金额 - 预设扣减(aumDeduction)

该机制保证了 GLP 持有者按比例获得金库的实际资产份额。

杠杆开启后的问题

enableLeverage 开启后,用户可以开设杠杆仓位(多头或空头)。攻击者在赎回 GLP 前,开设了大额的 WBTC 空头头寸。

由于空头一开仓便增加了全局空头规模,价格尚未变动的情况下系统默认该空头是亏损的,而这部分未实现亏损会被计为金库的“资产”,导致 AUM 人为上升。尽管金库并未实际获得额外价值,但赎回计算会基于这个虚高的 AUM,从而使攻击者获得了远超其应得的资产。

攻击流程

攻击交易

https://app.blocksec.com/explorer/tx/arbitrum/0x03182d3f0956a91c4e4c8f225bbc7975f9434fab042228c7acdc5ec9a32626ef?line=93

 

图片
图片

写在结尾

此次攻击暴露了 GMX 在杠杆机制与可重入保护设计上的严重缺陷。核心问题在于资产赎回逻辑对 AUM 的信任过高,未对其组成部分(如未实现亏损)进行足够审慎的安全校验。同时,关键函数对调用者身份的假设(EOA vs 合约)也缺乏强制性验证。该事件再次提醒开发者,在涉及资金敏感操作时,必须确保系统状态不可被操纵,尤其是在引入复杂金融逻辑(如杠杆、衍生品)时,更需严防重入与状态污染带来的系统性风险。

 

Criptos en tendencia

Lecturas Relacionadas

Must-Watch Events Next Week|CLARITY Act Could Face Senate Vote; SpaceX, Circle to Report Earnings (8.3-8.9)

**Summary: Key Events and Developments to Watch (August 3-9)** The upcoming week is marked by significant financial disclosures, key legislative deadlines, and notable product updates. **Major Financial Events:** Several companies are scheduled to release their Q2 2026 earnings. American Bitcoin (ABTC) will report on August 3, followed by SpaceX and Hut 8 Mining Corp. on August 4, and Circle on August 5. Notably, a significant portion of SpaceX shares (up to 12% of total shares) will be unlocked on August 6 following their earnings release. **Key Legislative Deadline:** The U.S. Senate faces an August 7 deadline to secure 60 votes for the CLARITY Act, a bipartisan bill aiming to establish a federal regulatory framework for cryptocurrencies. The Senate may hold a full vote on the bill during the week. **Economic Data:** The U.S. July Non-Farm Payrolls report will be released on August 7, providing crucial labor market data. **Technology & Product Updates:** * **Shutdowns:** DeFi portfolio tracker Zapper and wallet app Ctrl Wallet will cease operations on August 3. * **Upgrades:** LayerZero will deprecate its v1 relayers on August 3. XRP Ledger's new version 3.3.0, featuring five new functions, is expected next week. * **AI:** Elon Musk announced that the advanced Grok 4.6 AI model is set for release around August 7. * **Bitcoin:** The BIP-110 forced signaling for a potential Bitcoin network change is scheduled to begin around August 8. **Other Notable Events:** Chinese robotics firm Unitree Tech has set its preliminary price inquiry for its IPO for August 5. South Korean exchange Upbit will delist AQT and AERGO tokens on August 3.

marsbitHace 30 min(s)

Must-Watch Events Next Week|CLARITY Act Could Face Senate Vote; SpaceX, Circle to Report Earnings (8.3-8.9)

marsbitHace 30 min(s)

Stocks Are Plummeting More Sharply Than Cryptocurrencies. Where Has the Money Gone?

Stock Markets Plunge Deeper Than Cryptocurrencies: Where Did the Money Go? In late July, Seoul's Kospi index triggered circuit breakers for two consecutive days, plummeting over 40% from its June high. The collapse was led by heavyweight stocks like SK Hynix, whose record profits still disappointed investors, and devastating leveraged ETFs, with one major product losing over 83% of its value. This signaled a global, forced deleveraging targeting the most crowded trades. Interestingly, while stocks exhibited extreme volatility akin to crypto markets, Bitcoin rose nearly 15% in July after a prior steep drop. Analysis shows the money fleeing equities did not flow into Bitcoin. Instead, Bitcoin had already absorbed its sell-off in May-June, when U.S. spot Bitcoin ETFs saw historic outflows. The true safe-haven beneficiary was gold, whose price rose over 20% year-on-year, highlighting a decoupling between Bitcoin and gold as "digital gold." The sell-off was a targeted unwinding of leveraged positions in tech and semiconductors, accelerated by broker-dealer risk management and shifts in the AI narrative, including new competition from Chinese memory chipmakers. The retreat path was clear: from high-valuation tech stocks to cash and U.S. Treasuries, then to gold. For Bitcoin to attract sustained institutional inflows, conditions like eased global liquidity pressure, a "soft-landing" Fed rate cut, and U.S. regulatory clarity via legislation like the stalled CLARITY Act are needed. Currently, Bitcoin is not a safe haven but an already-cleared asset. Its low correlation with tech stocks, however, makes it a potential diversification play for institutional portfolios once the storm passes. The money isn't here yet, but the positioning is underway.

marsbitHace 30 min(s)

Stocks Are Plummeting More Sharply Than Cryptocurrencies. Where Has the Money Gone?

marsbitHace 30 min(s)

In Conversation with Ray Dalio: We Are Currently in an AI Bubble, with 1% of My Portfolio in Bitcoin

Ray Dalio, founder of Bridgewater Associates, warns in an interview that the current AI boom shows classic bubble characteristics, which could lead to significant economic downturns as seen in past cycles like 1929 or 2000. He explains that speculative enthusiasm, fueled by debt and overvaluation, often precedes a crash when rising rates or taxation force asset sales, causing widespread losses and recession. Dalio also outlines his "Big Cycle" theory, describing an approximate 80-year pattern where widening wealth gaps, massive government deficits, and shifting geopolitical power (like China's rise) create internal conflict and global instability. He emphasizes that we are in a late-cycle, transitional phase where traditional powers like the US and UK face decline. For personal wealth protection, Dalio advises diversification beyond cash into assets like stocks, bonds, real estate, and particularly gold, which he prefers over Bitcoin. While he holds about 1% of his portfolio in Bitcoin as a non-printable hard asset, he views gold as more secure from technological or governmental threats. Regarding AI's impact, Dalio believes it will disproportionately benefit capital owners, worsening inequality by replacing both physical and cognitive labor. He suggests that human intuition and emotional intelligence, combined with AI, will be key for future workers. On taxation, Dalio argues that wealth taxes are impractical and risk triggering asset sell-offs, reducing productive investment. He points to the UK as a cautionary example of debt, low productivity, and political strife. Geopolitically, Dalio foresees a more regionalized world, with the US showing weakness in prolonged conflicts like with Iran, akin to past imperial declines. The ideal outcome, he suggests, is coexisting powerful blocs (e.g., Americas, China-Asia Pacific) without major war.

marsbitHace 4 hora(s)

In Conversation with Ray Dalio: We Are Currently in an AI Bubble, with 1% of My Portfolio in Bitcoin

marsbitHace 4 hora(s)

Daily 7.2 Trillion KRW: Foreign Capital's Record Net Buying on Friday! Wall Street Says Headwinds for Korean Stock Fund Flows Have Subsided

South Korean stock market sees a dramatic shift in fund flows. On July 31, foreign investors made a record net purchase of approximately KRW 7.2 trillion in KOSPI stocks, marking a fundamental reversal from the persistent large-scale net outflows seen in previous months. This contributed to a significant narrowing of foreign net selling in July to KRW 9.8 trillion, down sharply from KRW 48.4 trillion in June and KRW 44.5 trillion in May. Simultaneously, domestic institutional pressure eased. South Korean pension funds and asset managers turned to a net buying position in July, purchasing KRW 1.0 trillion worth of KOSPI shares, contrasting with net sales in May and June. Market volatility is expected to be dampened by new financial regulations. Effective July 31, the Financial Services Commission tightened access for retail investors to single-stock leveraged ETFs by raising the minimum cash deposit requirement. Trading volumes for these products subsequently dropped to about 50% of their monthly average. Citigroup Research maintains its year-end KOSPI target of 10,000 points. The firm cites several supportive factors: the substantial easing of headwinds from capital outflows, a robust fundamental outlook for the semiconductor sector, historically low market valuations, strong economic fundamentals, and the potential for policy support from financial authorities if needed.

marsbitHace 4 hora(s)

Daily 7.2 Trillion KRW: Foreign Capital's Record Net Buying on Friday! Wall Street Says Headwinds for Korean Stock Fund Flows Have Subsided

marsbitHace 4 hora(s)

Trading

Spot

Artículos destacados

Cómo comprar GMX

¡Bienvenido a HTX.com! Hemos hecho que comprar GMX (GMX) sea simple y conveniente. Sigue nuestra guía paso a paso para iniciar tu viaje de criptos.Paso 1: crea tu cuenta HTXUtiliza tu correo electrónico o número de teléfono para registrarte y obtener una cuenta gratuita en HTX. Experimenta un proceso de registro sin complicaciones y desbloquea todas las funciones.Obtener mi cuentaPaso 2: ve a Comprar cripto y elige tu método de pagoTarjeta de crédito/débito: usa tu Visa o Mastercard para comprar GMX (GMX) al instante.Saldo: utiliza fondos del saldo de tu cuenta HTX para tradear sin problemas.Terceros: hemos agregado métodos de pago populares como Google Pay y Apple Pay para mejorar la comodidad.P2P: tradear directamente con otros usuarios en HTX.Over-the-Counter (OTC): ofrecemos servicios personalizados y tipos de cambio competitivos para los traders.Paso 3: guarda tu GMX (GMX)Después de comprar tu GMX (GMX), guárdalo en tu cuenta HTX. Alternativamente, puedes enviarlo a otro lugar mediante transferencia blockchain o utilizarlo para tradear otras criptomonedas.Paso 4: tradear GMX (GMX)Tradear fácilmente con GMX (GMX) en HTX's mercado spot. Simplemente accede a tu cuenta, selecciona tu par de trading, ejecuta tus trades y monitorea en tiempo real. Ofrecemos una experiencia fácil de usar tanto para principiantes como para traders experimentados.

107 Vistas totalesPublicado en 2024.12.10Actualizado en 2026.06.02

Cómo comprar GMX

Discusiones

Bienvenido a la comunidad de HTX. Aquí puedes mantenerte informado sobre los últimos desarrollos de la plataforma y acceder a análisis profesionales del mercado. A continuación se presentan las opiniones de los usuarios sobre el precio de GMX (GMX).

活动图片