On-chain security analysis — is it a scam or legit?
The GMX token contract is a highly privileged, upgradeable-style ERC-20 implementation.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 28, 2026
The 20 remaining pairs hold $1.5K between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x75df…97790x71ee…f2f30x46dd…63c90xb72c…e39f0x2b1f…9ee10x2d93…2a250xb18d…2eae0xbfab…c23a0x9557…e8560x3b67…fa56No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The 'mint' function allows privileged addresses to create new tokens, which can dilute the holdings of existing users. This is restricted to addresses designated as minters by the governance role.
Implement a time-lock on the minting function or require a multi-signature approval process for any increase in total supply.
Unresolved
The 'setInPrivateTransferMode' function allows the governance role to toggle a switch that can restrict or block token transfers for all users. This creates a risk where liquidity could be frozen by the protocol controllers.
Document the specific conditions under which this mode would be activated and consider adding a community-veto mechanism for such drastic changes.
Unresolved
Administrative roles can modify transfer fees and reward logic by changing non-staking account statuses. This allows controllers to influence the economic distribution of the token unilaterally.
Establish clear, transparent rules for fee adjustments and ensure these changes are communicated to the community in advance.
Unresolved
0.0% of the pool's LP is burned or time-locked. 86.0% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 43% of the token's DEX liquidity; the other pools were not assessed.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 80.5% of supply. What remains: 13.4% in wallets, 67.1% in other contracts. 297,575 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as GMX (GMX), market cap $92M, rank #294. Traded on Binance. 297,575 holders. Verified by: CoinGecko, exchange listings.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $587K (DexScreener, all pools). 24h trading volume $4.3M (CoinGecko, all markets, daily snapshot). 24h trading volume $618K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $91.07 on 2023-04-18; the price is now 90.524% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: gov — a contract. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $587K of DEX liquidity across 30 pools. Launch: 1877 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The GMX token contract is a highly privileged, upgradeable-style ERC-20 implementation. It features complex reward tracking and administrative controls that allow for minting, fee adjustments, and transfer restrictions. While the code is well-structured, the high degree of centralization poses a significant risk to token holders.
The contract implements standard ERC-20 functionality with robust internal reward tracking. 7.1 Architecture is modular, separating minting and administrative logic. 7.2 Code Security is high, utilizing safe math and standard patterns. 7.3 Access Control is strictly enforced via modifiers, though it relies heavily on centralized governance.
7.4 Economic and 7.5 Governance aspects are heavily centralized under the 'gov' and 'admin' roles. These roles have the power to mint tokens, modify transfer rules, and withdraw assets. This design allows for rapid protocol adjustments but requires high trust in the governance entity.
7.7 Upgrades are not implemented via proxy patterns in this specific contract. However, 7.8 Operations are highly flexible due to the extensive administrative functions. This allows for protocol evolution without needing contract migrations.
Token holders should monitor governance actions closely, as the 'gov' role has broad authority over token supply and transferability.
It is recommended to transition these privileged functions to a multi-signature wallet or a decentralized DAO structure to mitigate single-point-of-failure risks. Ensure that all administrative addresses are secured with hardware security modules or multi-party computation (MPC) to prevent unauthorized access to the 'mint' and 'setInPrivateTransferMode' functions.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The GMX contract on Arbitrum is 0xfc5a1a6eb076a2c7ad06ed22c90d7e710e35ad0a. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for GMX is 41/100 (Medium risk) as of Oct 28, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 28, 2026). Total DEX liquidity: $586.8K.
As of Oct 28, 2026, the 10 largest holders own 80.5% of the supply across 297,575 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
