# GMX Solana

> Not investment advice. Ratings describe on-chain configuration only and may contain errors.

Snapshot 2026-10-24, methodology v0.2. Source: Celebtir, CC BY 4.0.

## Summary

- Chain: Solana
- Category: perps
- Stage: Stage 0
- TVL: $26.49M
- Website: https://gmtrade.xyz/
- Core programs controlled by a Squads multisig
- Every core program has a verified build

## Value

- Stablecoins $24.16M, SOL $1.77M, BTC $15.77K, other $542.18K
- SOL (deposit): worst rating Low. no freeze, pause or seize power; native to Solana; mint authority renounced: supply is fixed; no transfer restrictions
- USDC (deposit): worst rating High. balances can be frozen by single key 7dGb…Crar; new supply can be minted by single key BJE5…5ruG

## Activity

- 24h volume: unavailable: no volume metric for this category; fees only
- 24h fees: $82.36K (−24.2% over 7 days)

## Risk summary

- High: An approved upgrade takes effect after 600 s. Withdrawal completion within that period is not established by these configuration facts.
- High: Program Gt9S41PtjR58CbG9JhJ3J6vxesqrNAswbWYbLNTMZA3c, which this protocol calls with user funds, can be upgraded by the unrecognized controller AAL4q1SZddd2SzdSa5ZBGDPHxRcoZE5RB7kNytK2edAD.
- Medium: Core program code can be replaced by 4 of 7 voters of multisig CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1.
- Medium: Protocol parameters can be changed by 4 of 7 voters of multisig CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1 using `authority`.

## Risk analysis

- Upgrade control: **Medium**. Squads v4 multisig, 4 of 7 voters, time lock 600 s. To improve: a multisig of 5+ voters at a 60%+ threshold → LOW, or make the program immutable.
  - Evidence: [CSp2sB68THdrJP6N7Au4Y5u89VJ1E1ebaqZ2soHhQvav](https://solscan.io/account/CSp2sB68THdrJP6N7Au4Y5u89VJ1E1ebaqZ2soHhQvav) `upgrade_authority` at slot 460976625
  - Evidence: [CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1](https://solscan.io/account/CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1) `threshold, time_lock, members, config_authority` at slot 460976626
- Upgrade delay: **High**. time lock 600 s. To improve: a time lock of 24 h+ → MEDIUM; 5 days+ → LOW.
  - Evidence: [CSp2sB68THdrJP6N7Au4Y5u89VJ1E1ebaqZ2soHhQvav](https://solscan.io/account/CSp2sB68THdrJP6N7Au4Y5u89VJ1E1ebaqZ2soHhQvav) `upgrade_authority` at slot 460976625
  - Evidence: [CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1](https://solscan.io/account/CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1) `threshold, time_lock, members, config_authority` at slot 460976626
- Admin powers: **Medium**. `authority` can change parameters, held by Squads v4 multisig, 4 of 7 voters, time lock 600 s. To improve: limit admin keys to parameters behind a 24 h+ time lock, or renounce them → LOW.
  - Evidence: [CTDLvGGXnoxvqLyTpGzdGLg9pD6JexKxKXSV8tqqo8bN](https://solscan.io/account/CTDLvGGXnoxvqLyTpGzdGLg9pD6JexKxKXSV8tqqo8bN) `authority` at slot 460976647
  - Evidence: [CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1](https://solscan.io/account/CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1) `threshold, time_lock, members, config_authority` at slot 460976626
- Code transparency: **Low**. verified build of https://github.com/gmsol-labs/gmx-solana/tree/8af1e70c0c0b6ff9d6b41ba4997910588fbcec28 at 8af1e70c0c0b6ff9d6b41ba4997910588fbcec28. To improve: none: LOW is the lowest risk level.
  - Evidence: [Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo](https://solscan.io/account/Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo) `verified_build` at slot 460976625
- Oracle dependency: **Unknown**. price feeds not yet listed in the registry. To improve: verify and register the protocol's price feeds.
  - Evidence: [CSp2sB68THdrJP6N7Au4Y5u89VJ1E1ebaqZ2soHhQvav](https://solscan.io/account/CSp2sB68THdrJP6N7Au4Y5u89VJ1E1ebaqZ2soHhQvav) `upgrade_authority` at slot 460976625
  - Evidence: [CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1](https://solscan.io/account/CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1) `threshold, time_lock, members, config_authority` at slot 460976626
- Dependencies: **High**. callee Gt9S…ZA3c is unrecognized controller AAL4…edAD. To improve: callees rated High need a multisig of 3+ voters at a 50%+ threshold → MEDIUM.
  - Evidence: [Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo](https://solscan.io/account/Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo) `transaction sample (50 transactions)` at slot 460976647
  - Evidence: [ARpB7g1R3hsySq5rYg4ApH5r9UMCpgAUdeWGcv9XSNwd](https://solscan.io/account/ARpB7g1R3hsySq5rYg4ApH5r9UMCpgAUdeWGcv9XSNwd) `upgrade_authority` at slot 460976696
  - Evidence: [AAL4q1SZddd2SzdSa5ZBGDPHxRcoZE5RB7kNytK2edAD](https://solscan.io/account/AAL4q1SZddd2SzdSa5ZBGDPHxRcoZE5RB7kNytK2edAD) `owner` at slot 460976698

## Stage

Stage 0. Stages describe who can change the protocol and how fast. They don't measure code security.

- [x] Stage 0: core programs identified in the registry (1 core programs)
- [x] Stage 0: public source for every core program (all core programs have public source)
- [x] Stage 0: upgrade control readable for every core program (upgrade control read for all core programs)
- [x] Stage 1: upgrade control rated Low or Medium (MEDIUM: Squads v4 multisig, 4 of 7 voters, time lock 600 s)
- [ ] Stage 1: upgrade delay of the Stage 1 minimum, unless upgrades need an emergency multisig (Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo: effective time lock 600 s; needs 5 days+ or an emergency multisig of 8+ voters at 75%+)
- [x] Stage 1: admin powers rated Low or Medium (MEDIUM: `authority` can change parameters, held by Squads v4 multisig, 4 of 7 voters, time lock 600 s)
- [x] Stage 1: no multisig has a single-key config authority (no single-key config authority)
- [x] Stage 1: verified builds for all core programs (all core programs verified)
- [ ] Stage 1: every factor could be read (Unknown caps the Stage at 0) (Unknown: Oracle dependency)
- [ ] Stage 2: core programs immutable, or upgradeable only through on-chain governance with a long delay (upgradeable without 30 days+ governance delay: Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo)
- [x] Stage 2: no key can move or freeze user funds (no admin key can move or freeze funds)

## Control graph

- Store → GMX Solana: core program
- authority → GMX Solana: admin account
- USDC → GMX Solana: used as deposit
- SOL → GMX Solana: used as deposit
- Single key → USDC: can freeze · no delay
- Single key → USDC: can mint · no delay
- Squads 4 of 7 · 600 s delay → Store: can upgrade · 600 s delay
- Squads 4 of 7 · 600 s delay → authority: can change parameters · 600 s delay

## Permissions

- Single key [7dGbd2QZcCKcTndnHcTL8q7SMVXAkp688NTQYwrRCrar](https://solscan.io/account/7dGbd2QZcCKcTndnHcTL8q7SMVXAkp688NTQYwrRCrar)
  - Freeze tokens: USDC (Circle), no delay
- Single key [BJE5MMbqXjVwjAF7oxwPYXnTXDyspzZyt4vwenNw5ruG](https://solscan.io/account/BJE5MMbqXjVwjAF7oxwPYXnTXDyspzZyt4vwenNw5ruG)
  - Mint tokens: USDC (Circle), no delay
- Squads 4 of 7 · 600 s delay [CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1](https://solscan.io/account/CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1)
  - Upgrade the code: Store, 600 s delay
  - Change parameters: authority on CTDL…o8bN, 600 s delay
- Held by no one: Freeze tokens (SOL (Solana (native mint)))
- Held by no one: Mint tokens (SOL (Solana (native mint)))

## Programs

- Store [Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo](https://solscan.io/account/Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo): core, Upgradeable loader, controller Squads 4 of 7 · 600 s delay, verified build of https://github.com/gmsol-labs/gmx-solana/tree/8af1e70c0c0b6ff9d6b41ba4997910588fbcec28, last upgrade 2026-10-21

## Upgrades & governance

- Upgrades: 10
- Last upgrade: 2026-10-21
- Average interval: 67.3 days
- 2026-10-21: upgrade Store ([transaction](https://solscan.io/tx/TBtfEHefZuMTwjhDJfKiDjyJCj874sS2XpmqzKj6oxCB1GjaRVhTph4EdYtfpa5u1661sHJkHqEhi4EPr8znvBT))
- 2026-10-21: extend Store ([transaction](https://solscan.io/tx/4V84MtTv4ZiAPe85SV2h8dXRuifskYJBAko9QBQsPtqu6kbQ5dqyJTMhNN6L3jBBGQWocmTQSnFzavauqMgkwS9p))
- 2026-08-12: upgrade Store ([transaction](https://solscan.io/tx/4uCgUJbqxgBmxc3f92qZe9oQSWsf6EFnAXi8CZBT9msvMp7yp6whehUL6T2b6nGtrDf1ZuwHNy3gDm48ckwJtZLu))
- 2026-03-19: upgrade Store ([transaction](https://solscan.io/tx/2iwm9ThG1bTnye2TjGdcunnpi5GKTFRyQr42MM274JRx9GoNXnMLm3bTErsV4ZLgp4LdDS3psDzbuYBYBYh4mD7g))
- 2026-02-11: upgrade Store ([transaction](https://solscan.io/tx/2sZCPDLqS4DpaNfRwo9oGUfzGrbUDehraFNn8Uafks1DHybi58igD2BWTDtDDRNu69LDMQmGdDfycwTqydvbhB1c))
- 2025-10-20: upgrade Store ([transaction](https://solscan.io/tx/vEB95BvtMCuYFzXvv3TH1mcgQfx37bAo818xHN6n42ipGKPAy9tHs78X3RehWtRwEWvA8TwpCgRuD9WBgg8b7wK))
- 2025-08-14: upgrade Store ([transaction](https://solscan.io/tx/cw5o8QjPpui1FpTXSZAueRb7te2kGAbtyVEGxtVvkTkbMdPX7ixfphwvgLQfLExmNJx24J1gVsgnbrDrUAFM6eP))
- 2025-08-05: upgrade Store ([transaction](https://solscan.io/tx/2LjvumiDJHPwwndD1q85nc4HnWQe1YDnmu8N9yr1FSkZb5AeZdDQdzguVA17BTjYb3495GUKRAubiabY95L1Gr9Z))
- 2025-08-05: extend Store ([transaction](https://solscan.io/tx/3nZWh25JAg2df6yCzpcx395cKB9VP1rNLKfLQ1hW8k3b31mu6AyDmbQBYYzqCVsbV9Ds96FQBqf1HWNGRkKKuy9S))
- 2025-08-05: extend Store ([transaction](https://solscan.io/tx/C4bgju26239rWpDrDy8J2mxnfJH2iyWKdWha6KSzLLgZ2nACCmJGLMvKDvJtYRtE8PqVHXpheuL9EsBh1JW1yWZ))
- 2025-06-22: upgrade Store ([transaction](https://solscan.io/tx/64P18gYyMLJ8A8ktfMipmBAZ5sRfsFMRQHc4VrT6zCgTZfxBb9gCXF3ZdanUEzTud9R2LfEte7QE9ZitVseDrJRj))
- 2025-06-22: extend Store ([transaction](https://solscan.io/tx/3ueVRGF9B3PWAUWsiWDF91k2itL1pRwHX7bB8ReouuzqQLN7f8veHRYqY1xamrLQwXe4DFnGqbVLGSY3kT2QiR1p))
- 2025-06-22: extend Store ([transaction](https://solscan.io/tx/Ari8eTG4A7iTi99mGGCq8S9zq3KeegLHQXJDorNGkr1qAnsfn1mq3jF2txHom64HuBtzw78ySxZbvBDAQxeVAZn))
- 2025-03-08: upgrade Store ([transaction](https://solscan.io/tx/3PeST5Yp316iNTJoU2rH6H6VXYtvwPA1R1Utj9EsS65xbRbb49rNTpubQwdTV7jZ593FG5DpcYg4CPpDPZNgjgih))
- 2025-03-08: extend Store ([transaction](https://solscan.io/tx/5QCuM4Q8LzCFKBm3ZbcV47HpmkDBHkALz8DRWVY8rYVUf6xYKSHygNXYjjpZdky7PjDxwDwoZoFz4rVUcB6RDyaq))
- 2025-03-08: extend Store ([transaction](https://solscan.io/tx/4ymikEnZdcaZRGZ8zviFqcYr9mmChBGUnAtnTG4CZDoc52FbGQ3npVkW2HsSC8EJPp8yBo72RmaXkaWid5yn1rBK))
- 2025-02-22: upgrade Store ([transaction](https://solscan.io/tx/iuTY2Hf3TYWZcmzoXqD7xdRy8L7cUatWGn2C9wEcoSVBW39gbbYf5E8PoeQo9F8FwLBCQkwiVPD1cH1sFRT7TBG))
- 2025-02-22: extend Store ([transaction](https://solscan.io/tx/3UshaxZHN1zutfb4fw1s5DWHDRQJ2quFrbT62yxd1shzUKdAVeHgyT7dapersw3UMkwfxVUR7A8SpyHqc6Y7oatc))
- 2025-02-22: extend Store ([transaction](https://solscan.io/tx/5WVgat3CskX3ioK4SJtnpLski1pBfCQdvghsK757zLP9cMT267HR8unian2wb75712byBxVbtKcKEPL5VoxHy22B))
- 2025-02-11: set authority Store ([transaction](https://solscan.io/tx/1i3EVBDF5X7vN4nxM4akPmow3wfzwfWJkuf7P1Xzu641sqHxzDirCMSWqqz4BoK44NousaBdWdYAeawPCbrUBQc))
- 2025-02-11: deploy Store ([transaction](https://solscan.io/tx/4is5ryMrLTPXHqFuhnZgsHdbiYZLieL8N68NbAddZouDwYxkuWekjukVe1fK5jRZjW9xkmYAfKDhRg4haXnSe8MJ))

## Updates

No changes have been recorded for this protocol since tracking began.

## Dependencies and sources

- Calls [Gt9S41PtjR58CbG9JhJ3J6vxesqrNAswbWYbLNTMZA3c](https://solscan.io/account/Gt9S41PtjR58CbG9JhJ3J6vxesqrNAswbWYbLNTMZA3c): Unrecognized, rated High
- Registry source for admin authority (CTDLvGGXnoxvqLyTpGzdGLg9pD6JexKxKXSV8tqqo8bN): https://solscan.io/account/CTDLvGGXnoxvqLyTpGzdGLg9pD6JexKxKXSV8tqqo8bN
- Registry source for multisig Squads v4 (CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1): https://solscan.io/account/CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1
- Registry source for multisig Squads v4 (CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1): https://solscan.io/account/CxnEVpQQcYa628TywzHGXeJ2jdVmbU51rnERat9xunP1
- Registry source for program Store (Gmso1uvJnLbawvw7yezdfCDcPydwW2s2iqG3w6MDucLo): https://docs.rs/crate/gmsol-store/latest/source/src/lib.rs
- Registry entry last reviewed: 2026-10-19 by celebtir-loop-draft

Web page: /protocols/gmx-solana/