No red flags found

app.gmx.io Arbitrum

Risk Index

10/ 100

Scanned 3 hours ago · 10 of 242 contracts checked

This dApp appears to be related to a synthetic asset trading or derivatives platform, given the presence of market tokens, GLV tokens, and reader contracts for market and position data.

The report status is 'No red flags found' with a risk index of 10. However, there are owner-controlled functions present in the code of the GlvToken, GMX, EsGMX, and MarketToken contracts, which is noted as a red flag. The report also indicates that buy/sell tax checks and ownership verification were not performed because the contracts lack an owner() function and other access control mechanisms have not yet been checked. The scope of the report covers the listed contracts on the Arbitrum chain.

AIAI explanation, may be wrong

Red flags 1

Owner-controlled functions in the code

The code has functions that let the owner change the rules: minting new tokens (GlvToken (0x528A…79F9), GMX (0xfc5A…ad0a) and 5 more). They are not harmful by themselves, but dangerous in the hands of a single wallet.
+10

Checklist

Code verifiedYes
Owner is a multisig or timelockUnknown
Withdrawals not controlled by one walletUnknown
Deployer is not a fresh walletYes
Deployer has no abandoned projectsUnknown
Contracts older than 7 daysYes
Not a honeypotYes

Contracts 10 of 242

The contracts the site uses most

Name	Role	Chain	Address	Verified	Owner	Age
DataStore This contract likely serves as a general-purpose data storage utility, managing various data types such as addresses, booleans, bytes32, integers, and strings for the protocol. AI	—	Arbitrum	0xFD70…92d8	Yes	No owner()	3y
Reader This contract appears to provide read-only access to various account and market data, such as orders, positions, deposits, and market information, facilitating data retrieval for users or other contracts. AI	—	Arbitrum	0xfA26…4184	Yes	No owner()	2mo
GlvReader This contract seems to handle reading and retrieving information related to GLV tokens, including deposits, withdrawals, token price, and shifts, acting as a data interface for GLV-related activities. AI	—	Arbitrum	0x85fc…65B1	Yes	No owner()	2mo
GlvToken This contract implements the GLV token with typical token functionalities, including minting and transferring, and interacts with a data store and role management system. AI	Token	Arbitrum	0x528A…79F9	Yes	No owner()	2y
GMX This contract likely implements the GMX token, including standard token functions like transfer and approval, as well as administrative functions such as minting and managing roles. AI	Token	Arbitrum	0xfc5A…ad0a	Yes	No owner()	5y
GlvToken This is another instance of the GLV token contract, providing similar token management functions and integration with data storage and role controls. AI	Token	Arbitrum	0xdF03…4b96	Yes	No owner()	2y
EsGMX This contract implements the EsGMX token, featuring standard token operations and administrative controls such as minting and managing non-staking accounts. AI	Token	Arbitrum	0xf42A…26cA	Yes	No owner()	5y
MarketToken This contract likely represents a MarketToken, providing token functionalities including minting, transferring, and role-based access control. AI	Token	Arbitrum	0x4701…561B	Yes	No owner()	3mo
MarketToken This is another MarketToken contract instance, offering similar token management features and role-based permissions. AI	Token	Arbitrum	0x0Df2…Cc4f	Yes	No owner()	5mo
MarketToken This MarketToken contract instance provides token operations including minting, transferring, and access control via roles. AI	Token	Arbitrum	0x2Ce2…b39b	Yes	No owner()	5mo

The site references 232 more contracts that no other team is known to own. Aegis checks the 10 the site relies on most; the rest were not checked and do not count in the Risk Index.

Not checked

These never count as passed

Buy / sell tax

The check could not run · 7 contracts
Who owns the contract

No owner() function; other access control (roles, a governor) is not checked yet · 10 contracts

What Aegis knows about this team

0xe60c…1D40 Deployer on Arbitrum

Wallet age
2mo

First funded by
0xE203…A882

Contracts created before
49+

Deployed here
Reader, GlvReader

Its contracts in Aegis data
50
0xF09d…A745 Deployer on Arbitrum

Wallet age
3y

First funded by
0xb383…0Cb4

Contracts created before
0

Deployed here
GlvToken, GlvToken

Its contracts in Aegis data
2
0x5F79…0Cf8 Deployer on Arbitrum · deployment service

Wallet age
5y

First funded by
0x1FcC…3Dc1

Contracts created before
20

Deployed here
GMX, EsGMX
0xD5F8…D460 Deployer on Arbitrum

Wallet age
2y

First funded by
0xE7Bf…a068

Contracts created before
0

Deployed here
MarketToken, MarketToken

Its contracts in Aegis data
2
0xE7Bf…a068 Deployer on Arbitrum

Wallet age
3y

First funded by
high-volume wallet (exchange / bridge / faucet)

Contracts created before
50+

Deployed here
DataStore

Its contracts in Aegis data
53

Also behind
app.hypervault.finance (High risk)
0xB10e…99Cc Deployer on Arbitrum

Wallet age
8mo

First funded by
0xC2bB…D151

Contracts created before
3

Deployed here
MarketToken

Its contracts in Aegis data
4

Other sites that use the same contracts: app.hypervault.finance (High risk). The same team, or one site copying the other: make sure you opened the address you meant to.

Links on the site

This report describes on-chain facts and risk signals found by automated checks. Not financial advice: do your own research before you sign anything.

Report a mistake in this report

Owner-controlled functions in the code

Buy / sell tax

Who owns the contract