NexFlow › Library › Hyperliquid vs GMX

Hyperliquid vs GMX: the order book versus the pool that prices everything from oracles

The two dominant answers to on-chain perps disagree about what the counterparty even is. Hyperliquid runs a real order book on its own L1; GMX prices every trade from oracles against a pooled LP counterparty. One of them has a $42M exploit-and-return file worth reading.

Comparison · 9 min read · updated 2026-09-28 · not financial advice

Hyperliquid and GMX both custody nothing — margin stays in contracts — but they disagree fundamentally about who you're trading against. Hyperliquid rebuilt the exchange: a real order book as an L1 primitive, other traders on the other side, HLP absorbing the leftovers. GMX removed the book entirely: every trade prices off an oracle and fills against a pooled LP counterparty at zero slippage — an elegant model with a documented scar.

Every row below names its source and date.

The parameter table

Book vs pool: what you're actually trading against

On Hyperliquid you trade against a market: bids, asks, and liquidations execute on a CLOB embedded in a purpose-built chain, with HLP as the visible backstop vault. The model's strengths are price discovery and depth; its weakness is that a book can be gamed at the margin — the JELLYJELLY episode ended with validators force-settling the market.

On GMX there is no book to game: every fill quotes off Chainlink-class oracles at zero price impact, and the GLP/GM liquidity pool is always the counterparty. Traders get guaranteed execution; LPs get fee income minus trader P&L — meaning a sustained run of profitable traders is paid directly out of LP value. It is the only major perp design where the house is literally a token you can hold — and where the house's solvency is an on-chain number anyone can audit.

The Jul-2025 file — a drain that came back

On Jul-9-2025, GMX V1 on Arbitrum lost ~$42M of its ~$46M GLP pool to a cross-contract reentrancy: a malicious receiver contract called into the Vault mid-transaction, bypassing ShortsTracker's globalShortAveragePrice update, inflating the GLP AUM, and redeeming at the inflated price. The guard that failed had held four years — the vulnerable interaction was inside V1, the deprecated-but-still-live version.

Then the unusual part: GMX offered 10% and no prosecution; the exploiter returned ~$37M (keeping ~$5M, part of it routed through Tornado Cash per on-chain reporting), the DAO made affected LPs whole, and governance moved to sunset V1 — pausing it on Arbitrum and Avalanche and holding the epoch's fees in treasury. It is one of the cleanest exploit-recovery outcomes on record at that size anywhere in DeFi, and also a permanent reminder that a deprecated contract is still a live, funded attack surface.

Earlier scars and what they taught

GMX's first documented exploitation was Sep-2022: the zero-slippage design itself was the attack — a trader manipulated the thin AVAX market elsewhere and executed ~$565K of oracle-priced profit against the pool. The fix was OI caps, not code. That incident priced the model's core assumption honestly: oracle-priced execution is only as honest as the oracle's source markets, and a guarantee of zero slippage is a guarantee that manipulations land on the LPs.

Hyperliquid's file is younger and governance-shaped: no contract drain, but the JELLYJELLY force-settle demonstrated that a small validator set can override markets mid-flight. Neither file ends in user fund loss; they just fail differently — GMX at the code layer (once, then returned), Hyperliquid at the discretion layer (once, by design).

Holding the house: what LP tokens actually promise

Both venues let you own a piece of the counterparty, but the instruments carry opposite profiles. GMX's GM/GLP is the counterparty itself: you collect fee share and you pay trader profits directly — a sustained winning streak by traders comes out of your position. The July exploit priced the tail of that deal: the pool held the risk, the pool got drained, and governance then made the pool whole.

HLP is structurally different — a vault that earns market-making spread and liquidation flow behind a normal order book, not a basket that guarantees every fill. Its P&L is public and its discretion (the JELLYJELLY absorption) is exercised by validators rather than by formula. In both cases “holding the house” means holding the venue's residual risk; the difference is whether that risk arrives as a formula carved in the contract or as a governance decision taken in the moment by named humans.

Who should pick which

Pick Hyperliquid if you want real order-book execution — limit orders that actually work, market-grade depth, public funding, and the inspectable HLP backstop — and accept the concentrated validator set. Pick GMX if you want zero-price-impact execution, oracle-guaranteed fills on big size, and the ability to hold the counterparty (GM/GLP) as a yield position — and accept that the counterparty model carries both trader-P&L risk and a now-twice-tested, publicly-postmortemed contract surface. The designs are complementary enough that sizing across both is the standard answer for on-chain perp exposure, since their failure modes barely overlap.

Frequently asked