ERC-4626 virtual-share offset (OZ ≥4.9)
GMX v2 (GMX Synthetics)'s assessment for RD-F-074 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
GM tokens (market tokens) are standard ERC-20 tokens. MarketToken.sol source-code confirmed: declared as 'contract MarketToken is ERC20, Bank' — it inherits from OpenZeppelin ERC20 and a custom Bank contract. It does not implement the ERC-4626 vault interface (no deposit(), withdraw(), redeem(), totalAssets(), convertToShares(), convertToAssets() functions). The OpenZeppelin version in use is 4.9.3 per the data cache (github.oz_contracts_version). The ERC-4626 virtual-share inflation attack (where an attacker rounds down share minting via the virtualOffset in the 4626 accounting) does not apply to MarketToken because share accounting is handled externally in ExecuteDepositUtils.sol and MarketUtils.sol, not via the ERC-4626 interface. The analogous first-depositor protection is assessed under RD-F-075. Factor RD-F-074 is not applicable.
Sources #
- GitHubGMX synthetics — MarketToken.sol source (ERC20+Bank inheritance, no Compound interface)https://raw.githubusercontent.com/gmx-io/gmx-synthetics/main/contracts/market/MarketToken.solretrieved 2026-05-05
- GMX synthetics GitHub repo — OZ 4.9.3, non-ERC-4626 market token architecturehttps://github.com/gmx-io/gmx-syntheticsretrieved 2026-05-05
Methodology #
Determine whether ERC-4626 vaults use OpenZeppelin ≥4.9 virtual-share offset pattern to prevent first-depositor share-inflation.
See the full factor methodology and distribution across all protocols →