# Tracking of the latest ADL block use the wrong block number on Arbitrum

GMX ADL state tracked with L1 block.number on Arbitrum instead of L2 block number, letting the ADL keeper execute ADL orders anytime, causing slippage losses.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: GalloDaSballo
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/150
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AdlUtils.updateAdlState / setLatestAdlBlock in gmx-synthetics
**Root cause:** setLatestAdlBlock() is passed block.number, which on Arbitrum is the L1 block number, while ADL eligibility checks compare against L2 oracle block numbers; L1 numbers lag far behind L2, so the latest-ADL-block check always passes.
**Steps:**
1. Read AdlUtils.updateAdlState() line 114: `setLatestAdlBlock(dataStore, market, isLong, block.number)`
2. Note Chain.currentBlockNumber() is used elsewhere for L2 block numbers
3. Observe ADL eligibility check at AdlUtils.sol#L192-195 compares stored block against L2 oracle block numbers
4. On Arbitrum, block.number returns L1 number, far behind L2, so the cooldown/eligibility check passes
5. ADL keeper can call executeAdl whenever it wants, causing slippage losses to users
**How found:** Code review comparing block.number usage against Chain.currentBlockNumber() used elsewhere; recognized Arbitrum L1 vs L2 block number semantics.
**Exploitation:** ADL keeper (privileged) triggers ADL orders outside the intended window because the latest-ADL-block guard is effectively always satisfied, exposing users to slippage losses.
**Insight:** On Arbitrum/Optimism-style L2s, block.number returns the L1 block number, not the L2 number; any cooldown or ordering logic keyed on block.number silently breaks. Grep for block.number in L2 contracts and compare against the chain abstraction helper.