SlowMist: GMX Theft Leads to GLP Price Manipulation, Attacker Manipulates Global Average Price by Creating Large Short Positions through Reentrancy

BlockBeats News, July 10th. SlowMist Cosmos stated in a post that the fundamental reason for the $42 million theft of GMX last night was that GMX v1 would immediately update the global short average price when handling short positions. This global average price directly affects the calculation of the total asset under management (AUM), leading to the manipulation of the GLP token price.

The attacker exploited this design flaw by using a Keeper to enable the timelock.enableLeverage feature when executing orders (a necessary condition for creating large short positions), successfully creating a large short position through reentrancy to manipulate the global average price. This artificially inflated the GLP price in a single transaction and profited through redemption operations.