Some prerequisites to implement this attack:
The total short position value of the BTC market in GMX v1 is ~15k USD before being exploited. The size is too small and makes it vulnerable to being manipulated; the average entry price of global shorts is ~108k at that time.
When the BTC market price went above 108k, the attacker started the loop to manipulate the average price: opening a short position through `Vault`, then closing it through `PositionRouter`.
Each time opening a short position ignores the updating average price in `ShortsTracker` contract, making the average entry price unchanged, which should be increased when the market price > average price
Because the average entry price is below both the market price and the actual average price, closing a short position results in greater-than-expected losses, further depressing the calculated average price.
After 5 loops, the average entry price of global shorts was manipulated from 108k to 1.9k in the `ShortsTracker` contract.
The attacker then opens a huge short position via `Vault`. This action increases the global short size without affecting the global average price, leading to a huge unrealized loss for the global short positions and inflating the value of GLP.
Neodyme@Neodyme
@GMX_IO V1 has been hacked. Here is how:
English
