Crypto · DEX review

GMX review 2026: why it ranks among the more decentralized perp DEXs, and the risks that remain

By VoxTradePro Desk · Published 2 Nov 2026, 16:15 UTC+8 · 9 min read

A source-based GMX v2 review: wallet trading, GM pools, Chainlink oracles, keepers, 24-hour timelocks, fees, staking, audits, regions and the 2025 v1 exploit.

Educational review only, not financial advice. Facts come from GMX's own docs, code, terms and blog, and from on-chain reads, all checked on 2 November 2026. GMX changes often, so check the live pages before you use it.

GMX is one of the longest-running perpetual futures exchanges built on smart contracts. In our side-by-side comparison, Which DEX Is Really Decentralized?, GMX v2 ranked third among perp venues, behind dYdX Chain (v4) and gTrade. This review explains why it ranks well, and why it is not first. It follows our Aster and Hyperliquid reviews and uses the same questions: who holds the money, who can change the rules, and who can stop you.

How GMX v2 works, in plain words

GMX describes itself as "a decentralized spot and perpetual exchange on Arbitrum, Avalanche, and MegaETH", with perpetual trades of "up to 100x leverage" and "100+ markets", including crypto and TradFi markets such as gold, oil and US stock indices (GMX docs).

There is no order book. Every trade is made against a liquidity pool at an oracle price:

GM pools. Each market has its own pool with a "long token" and a "short token", for example WETH and USDC. GMX says each GM pool "is risk-isolated": liquidity providers are only exposed to the markets they deposit into (providing liquidity).
GLV vaults spread liquidity across several GM markets automatically. GMX says its "risk team" sets which markets each GLV supports and how much it can hold in each.
Liquidity providers are the counterparty. When traders win, the pool pays; when traders lose, the pool gains. Fees also flow into the pool.
Oracle prices. GMX uses Chainlink Data Streams. Its governance forum explains that the signed price reports are fetched off-chain and "validated on-chain by checking the cryptographic signatures" (GMX governance).
Keepers. A trade happens in two steps. The trader sends an order request; then an order keeper bundles signed prices with it and executes it (gmx-synthetics README).

Custody: trading from your own wallet

On Arbitrum, Avalanche and MegaETH, a trader can use direct wallet trading: funds stay in the trader's own wallet until they are sent into the contracts as margin for a position (trading overview). There is no exchange account to deposit into first. Unused funds simply stay in the wallet.

GMX's terms say GMX.io does "not have possession, custody, or control over any user's funds" (terms).

Two newer features add other parties, so it helps to know which mode you are in:

GMX Account (multichain). This is "a separate trading balance on Arbitrum" that can be funded from chains such as Ethereum, Base or BNB. Deposits are bridged using Stargate and LayerZero, which adds bridge dependencies, and the docs note bridging "is limited by Stargate liquidity caps".
Express and One-Click Trading. The trader signs messages off-chain and "GMX Relay, GMX's self-hosted relay" sends them on-chain. One-Click uses "a locally stored sub-account key". Classic Trading uses the trader's own wallet and RPC for every transaction.

Withdrawals and exits

To get money out, a trader closes or reduces a position, and the collateral and any profit return to the wallet (or to the GMX Account balance, depending on which was used). Because closes are executed by keepers, an exit depends on keepers and oracle prices being live. GMX's own known issues list says that "during downtime of the blockchain or oracle, orders may be executed at significantly different prices or may not execute", and that on Arbitrum-style chains oracle keepers "must stop signing prices if the sequencer stops producing blocks". We did not find a documented way for a trader to close a position without a keeper.

Liquidity providers face their own limit: selling GM tokens can be blocked when traders' open profit is too large relative to the pool. The app then shows "Withdrawal unavailable" (providing liquidity).

Who can change the rules: roles and timelocks

GMX v2 is upgradeable in a specific way. GMX's architecture page explains:

All privileged actions go through a RoleStore. "Handlers, keepers, and governance controllers each hold specific roles."
Most parameter changes go through a ConfigTimelockController, based on OpenZeppelin's TimelockController, "that enforces time delays on sensitive updates".
Logic upgrades work by deploying new contracts and granting them roles; the vault ("bank") contracts and DataStore stay in place, so "no fund migration is required".

How long is the delay? We read the two timelock controllers listed for Arbitrum on GMX's addresses page directly on-chain. Both return a minimum delay of 86,400 seconds (24 hours). That gives users a day's warning of most changes, which is far better than no delay. But it is shorter than gTrade's 14-day timelock for fund-affecting vault changes, and short for anyone who checks only now and then.

GMX's own code README is candid about what the privileged roles could do: "Config keepers and timelock admins could potentially disrupt regular operation through the disabling of features, incorrect setting of values, whitelisting malicious tokens", and "order keepers and frozen order keepers could potentially extract value through transaction ordering, delayed transaction execution, ADL execution, etc." It adds that "the timelock multisig should revoke the permissions of malicious or compromised accounts" (README). In other words, there are trusted operators, and their power is limited by roles and a delay, not removed.

Token governance. GMX holders vote on GMX Improvement Proposals on Tally, with a 65% qualified majority, a 5-day voting window and a 24-hour execution delay (proposal process).

Open source and audits

The v2 contract code is public in the gmx-synthetics repository. Its LICENSE file is the Business Source License 1.1, which states it changes to GPL v2 or later on "the earlier of 31 August 2026 or a date specified" by the licensor. So the code can be read and checked by anyone; reuse rights depend on that licence.

GMX's security page lists audits by Guardian (its primary auditor, which "continues to audit all smart contract updates"), ABDK, Certora, Dedaub and Sherlock, plus a bug bounty on Immunefi. Audits lower risk; they do not remove it.

Fees

From GMX's fees page:

Open/close fee: 0.04% of position size if the trade improves the long/short balance, 0.06% if it worsens it. Some TradFi markets use other rates.
Swap fee: 0.05% or 0.07% for standard swaps.
Price impact: charged or credited when closing, based on the long/short imbalance.
Funding and borrowing fees: these change over time with market balance. Funding can be a cost or a credit.
Network fees: gas, or the Express fee paid in the chosen gas token.

On Arbitrum and Avalanche, GMX says 63% of fees go to liquidity providers and 37% to the protocol (providing liquidity).

The GMX token and staking

GMX is the utility and governance token. According to the token page:

27% of protocol fees are used to buy back GMX. Staking earns a share of these buybacks, but the docs say "GMX staking rewards are suspended": bought-back GMX "accumulates in the Treasury and will be distributed to stakers when GMX reaches $90".
Unstaking takes 180 days.
8.8% of v2 fees go to the treasury and 1.2% to Chainlink.
The forecast maximum supply is 13.25 million GMX; minting more needs a governance vote.

Anyone thinking of staking should weigh the 180-day exit and the fact that rewards are on hold.

Restricted regions

GMX's Terms and Conditions (last modified 20 August 2026) could not be read on the website itself in our tools, because it is a JavaScript app. We read the same text from the official interface code on GitHub. It says users must confirm:

"You are not a U.S. Person".
They are not in a country under US, UK or EU embargoes or similar sanctions ("Restricted Territories").
They are not on sanctions lists.
They will not use "VPN software or any other privacy or anonymization tools" to get around restrictions.

The terms also allow GMX.io to "modify, suspend or disable" the site or interface "for any reason whatsoever". They add that the protocol "would still be accessible via a third party since we do not host or own its code". If you are in a restricted region or are a US person, the terms say not to use GMX. Do not look for ways around that.

Incidents

July 2025, GMX v1 (not v2). On 9 July 2025 a vulnerability in the older GMX v1 deployment on Arbitrum let about $40 million of GLP liquidity be withdrawn to an outside wallet. GMX says the funds were "fully recovered", a "$5m bug bounty was paid to the user who uncovered this vulnerability", and "GMX V2 is unaffected by this vulnerability" (GMX blog, 16 July 2025). We found no other GMX v2 incident we could verify from primary sources for this review.

Why GMX ranks well, and why it is third

Strengths (based on the sources above):

Direct wallet trading: no exchange account, and no company holding user funds.
Contracts on public chains with public code, multiple audits and a bug bounty.
Prices from a decentralized Chainlink oracle network, checked on-chain by signature.
Most changes pass a 24-hour timelock, and token holders vote on proposals.
The terms say the protocol stays reachable through third parties if the official site drops someone.

Why it is behind dYdX Chain and gTrade in our ranking:

Trades and exits depend on keepers with special roles. GMX's README says they could disrupt operation or extract value.
The 24-hour timelock is real but short compared with gTrade's 14-day delay on fund-affecting vault changes.
Unlike dYdX Chain, GMX relies on the Arbitrum (or Avalanche/MegaETH) chain and its sequencer, and on GMX-run services such as the relay for Express trading.

Risks to keep in mind

Leverage and liquidation: up to 100x leverage magnifies losses.
Smart contract risk: audits do not make code bug-free, as the v1 incident showed.
Keeper, oracle and chain downtime: orders may not execute or may fill at different prices.
Liquidity provider risk: GM and GLV holders take the other side of traders' profits, and withdrawals can be paused by pool limits.
Bridge risk: this applies if you use the GMX Account from other chains.
Stablecoin issuer risk: USDC and USDT can be frozen by their issuers, as explained in our comparison.

Who it suits

GMX may suit a trader outside restricted regions who wants to keep funds in their own wallet, prefers oracle pricing over an order book, and is comfortable relying on keepers and a 24-hour timelock. It may suit less well a trader who wants an on-chain order book, the strongest exit guarantees, or no reliance on operator-run services. Whatever the venue, size positions so a delay or outage cannot ruin you; see risk management basics and futures, spot and CFDs. Keep a separate, clean trading wallet, as in our dusting case study.

Related: Which DEX Is Really Decentralized? · Aster review · Hyperliquid review · live prices on our Ethereum and Bitcoin pages.

Sources

Not financial advice. This article is for general information and education only. It is not a recommendation to buy, sell or hold any asset. Prices move quickly and figures quoted may already be out of date; markets involve risk, including the loss of capital. See our disclaimer.

Related markets: Ethereum Bitcoin Solana