fix(gmx-v2): fix createDeposit/createWithdrawal selectors + gas override#238
fix(gmx-v2): fix createDeposit/createWithdrawal selectors + gas override#238GeoGu360 wants to merge 2 commits intoMigOKG:mainfrom
Conversation
… override - Fix createDeposit selector: adc567e6 → c82aa41b (real deployed selector) - Fix createWithdrawal selector: 9b8eb9e7 → e78dc235 (real deployed selector) - Rewrite both functions with correct flat-struct ABI encoding - Add wallet_contract_call_with_gas to bypass gas estimation failures - Switch all write commands to use wallet_contract_call_with_gas with explicit gas limits (300k/500k/800k) to avoid eth_estimateGas failures when approval tx is not yet confirmed All 11 GMX V2 commands tested live on Arbitrum: - get-markets, get-prices, get-funding-rates, get-positions, get-orders (read) - deposit-liquidity, withdraw-liquidity (GM token lifecycle) - place-order (LimitIncrease/StopLoss), cancel-order (StopLoss) - claim-funding-fees Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 72/100
1. Plugin Overview
Summary: This plugin enables AI agents to interact with the GMX V2 perpetual and liquidity protocol on Arbitrum and Avalanche. It supports opening/closing leveraged positions, placing limit/stop-loss/take-profit orders, depositing/withdrawing GM pool liquidity, querying markets/prices/positions/orders, and claiming funding fees. All on-chain write operations are delegated to Target Users: DeFi traders seeking leveraged perpetual positions on GMX V2, liquidity providers wanting to manage GM pool positions, and automated trading agents operating on Arbitrum or Avalanche. 2. Architecture AnalysisComponents:
Skill Structure:
Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin has high financial operation capabilities: it constructs calldata for leveraged perpetual trading (open/close positions with up to arbitrary leverage), conditional orders (limit, stop-loss, take-profit), GM pool liquidity operations (deposit/withdraw), ERC-20 token approvals, and funding fee claims. All on-chain writes are correctly delegated to 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — All on-chain write operations (wallet signing, transaction broadcasting, contract calls, token approvals) are delegated to On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations use 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
TF005 is triggered: Prompt Injection Scan
The pre-flight section contains a base64-encoded string ( Result: Dangerous Operations CheckThe plugin involves:
Confirmation steps:
Result: Data Exfiltration Risk
Result: Overall Security Rating: 🔴 High RiskThe TF005 toxic flow (curl|sh + financial operations) triggers a FAIL condition. Additionally, the 6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisKey dependencies (from Cargo.toml):
No suspicious, unmaintained, or known-vulnerable dependencies detected. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — The SKILL.md accurately describes the plugin's capabilities: 11 commands for GMX V2 operations, all write operations via onchainos wallet contract-call, read operations via GMX APIs and direct RPC calls. The dry-run + confirm flow described in SKILL.md matches the source code implementation. Verdict: ✅ Source Safe7. Code ReviewQuality Score: 72/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: A well-architected GMX V2 plugin that correctly delegates all on-chain writes to onchainos, but contains critical supply chain risks ( Merge recommendation: 🔍 Needs changes before merge Specific items that must be addressed:
Generated by Claude AI via Anthropic API — review the full report before approving. |
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
list-markets |
View active perpetual markets with liquidity and rates |
get-prices |
Get current oracle prices for tokens |
get-positions |
Query open positions for a wallet |
get-orders |
Query pending conditional orders |
open-position |
Open leveraged long/short positions |
close-position |
Close existing positions (full or partial) |
place-order |
Place limit/stop-loss/take-profit orders |
cancel-order |
Cancel pending conditional orders |
deposit-liquidity |
Add tokens to GM pools for LP rewards |
withdraw-liquidity |
Remove liquidity from GM pools |
claim-funding-fees |
Claim accrued funding fee income |
Triggers
Activate when users mention GMX trading, opening/closing leveraged positions, setting stop losses or take profits, providing liquidity to GM pools, or querying perpetuals market data on Arbitrum or Avalanche.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall gmx-v2 binary (auto-injected)
if ! command -v gmx-v2 >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/gmx-v2@0.1.0/gmx-v2-${TARGET}${EXT}" -o ~/.local/bin/gmx-v2${EXT}
chmod +x ~/.local/bin/gmx-v2${EXT}
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/gmx-v2"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"gmx-v2","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"gmx-v2","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
3d6bbfa to
7aedd3b
Compare
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
GeoGu360
force-pushed
the
fix/gmx-v2-selectors
branch
from
64036b2 to
7aedd3b
Compare
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
✅ Phase 1: Structure Validation — PASSED→ Proceeding to Phase 2: Build Verification |
|
Closing to reopen with a properly synced fork base. |
1 participant
Summary
Testing
All 11 GMX V2 commands tested live on Arbitrum mainnet:
🤖 Generated with Claude Code