Slow Fog: GMX was attacked because the global average price of GMX v1 short positions can be manipulated, and the GLP price was maliciously inflated for arbitrage.

Odaily News Slow Fog CISO @im23pds posted on the X platform stating: "The fundamental reason GMX was attacked is that GMX v1 immediately updates the global short average price when handling short positions, and this global average price directly affects the calculation of total assets under management (AUM), which in turn leads to manipulation of the GLP Token price. The attacker exploited this design flaw by using Keeper to enable the timelock.enableLeverage feature during order execution (a necessary condition for creating large short orders), successfully creating large short positions through re-entrancy to manipulate the global average price, artificially raising the GLP price in a single transaction and profiting through redemption operations."