জিএমএক্সে $40M হ্যাক: রিএনট্রানসি বাগের রহস

The Attack Vector: A Reentrant Trap

জিএমএক্স্‌এর হ্যাকটি shuru hoyeche jaben attackers unstakeAndRedeemGlp-কল कরছিল—EOA-এরপদূ EOA-এরপদূ smart contract address pass korar maddhme executeDecreaseOrder। eta validation layer ke bypass kore, attacker-re re-enter kore redemption loop-er moddhe। har recursive call AUM calculation inflate kore: AUM = total token pool value − unrealized losses − reserved amounts.

The Leverage Amplifier

enableLeverage enabled chilo, GLP-k leverage position-e parin korechilo। attackers redeem er aghe massive WBTC short positions khulechilo। GLP withdraw hoite system stale data diye AUM recalibrate kore—unrealized losses settle hoini, kintu real assets hisabe treat kora holo। eta artificial surplus create kore, attacker-re proportional share er cheye beshi claim korar chance dilo.

Why It Worked: Broken Trust in Logic

eta code er bug nO—a assumption er failure. amra manechhi EOA inputs safe; amra caller identity validate kori ni state transition level-e। DeFi-te trust zero-sum hote chai—not optimistic.

The Aftermath: Systemic Risk Lingers

AUM dynamic ba speculative hote chai na—it was supposed to be an oracle of true exposure. Kintu leverage ar reentrancy guardrail binO jokhon collide hole, even elegant math weaponized hoye jay.

I’ve reviewed this transaction on Arbitrum (0x03182d3f…). The flaw is architectural—not accidental. If your protocol doesn’t audit external calls as strictly as it audits balances—you’re not building DeFi. You’re building a casino.