fix(gmx-v2): fix createDeposit/createWithdrawal selectors + gas override#239
fix(gmx-v2): fix createDeposit/createWithdrawal selectors + gas override#239GeoGu360 merged 2 commits intoMigOKG:mainfrom
Conversation
… override - Fix createDeposit selector: adc567e6 → c82aa41b (real deployed selector) - Fix createWithdrawal selector: 9b8eb9e7 → e78dc235 (real deployed selector) - Rewrite both functions with correct flat-struct ABI encoding - Add wallet_contract_call_with_gas to bypass gas estimation failures - Switch all write commands to use wallet_contract_call_with_gas with explicit gas limits (300k/500k/800k) to avoid eth_estimateGas failures when approval tx is not yet confirmed All 11 GMX V2 commands tested live on Arbitrum: - get-markets, get-prices, get-funding-rates, get-positions, get-orders (read) - deposit-liquidity, withdraw-liquidity (GM token lifecycle) - place-order (LimitIncrease/StopLoss), cancel-order (StopLoss) - claim-funding-fees Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
list-markets |
View active perpetual markets with liquidity and rates |
get-prices |
Get current oracle prices for tokens |
get-positions |
Query open leveraged positions |
get-orders |
Query pending conditional orders |
open-position |
Open long/short leveraged position |
close-position |
Close existing position (full/partial) |
place-order |
Place limit/stop-loss/take-profit orders |
cancel-order |
Cancel pending conditional order |
deposit-liquidity |
Add tokens to GM liquidity pools |
withdraw-liquidity |
Remove liquidity and burn GM tokens |
claim-funding-fees |
Claim accrued funding fee rewards |
Triggers
Activate when users want to trade leveraged perpetuals, manage derivatives positions, or provide liquidity on GMX V2. Common phrases include "open GMX position", "GMX leverage trade", "deposit GM pool", "set stop loss", or "claim funding fees".
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall gmx-v2 binary (auto-injected)
if ! command -v gmx-v2 >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/gmx-v2@0.1.0/gmx-v2-${TARGET}${EXT}" -o ~/.local/bin/gmx-v2${EXT}
chmod +x ~/.local/bin/gmx-v2${EXT}
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/gmx-v2"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"gmx-v2","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"gmx-v2","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 72/100
1. Plugin Overview
Summary: This plugin enables AI agents to trade perpetuals and spot on GMX V2 protocol — opening/closing leveraged positions, placing limit/stop orders, adding/removing GM pool liquidity, and claiming funding fees on Arbitrum and Avalanche chains. It uses a custom Rust binary that constructs GMX V2 multicall calldata and delegates signing/broadcasting to Target Users: DeFi traders who want AI-assisted leveraged perpetual trading on GMX V2, liquidity providers managing GM pools, and automated trading strategies on Arbitrum/Avalanche. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin has high financial risk: it can open/close leveraged perpetual positions, place conditional orders, add/remove liquidity from GM pools, approve ERC-20 tokens, and claim funding fees. All on-chain write operations are delegated to 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — All blockchain write operations go through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations are routed through 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
Prompt Injection Scan
Result: Dangerous Operations Check
Result: Data Exfiltration Risk
Result: Overall Security Rating: 🔴 High RiskThe combination of 6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisKey dependencies from Cargo.toml:
No suspicious, unmaintained, or vulnerable dependencies detected. All crates are from well-known Rust ecosystem libraries. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes, with one caveat:
Verdict: ✅ Source SafeThe source code is clean, well-structured, and accurately implements the described functionality. All write operations correctly delegate to onchainos. No unsafe code, no hidden network calls, no credential handling. 7. Code ReviewQuality Score: 72/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-architected GMX V2 plugin with proper onchainos delegation for all write operations, but SKILL.md pre-flight section contains critical security issues ( Merge recommendation: 🔍 Needs changes before merge Items that must be addressed:
Generated by Claude AI via Anthropic API — review the full report before approving. |
1 participant
Summary
Testing
All 11 GMX V2 commands tested live on Arbitrum mainnet:
🤖 Generated with Claude Code