Keepers: DeFi’s Blind Spot
Keepers are external bots or services that monitor onchain activity and initiate transactions when predefined conditions are met. Because they can occupy privileged positions within a protocol’s execution flow, the risks extend beyond downtime, congestion, or compromised private keys. The execution path itself can become an attack surface.
GMX V1 Keeper Execution-Flow Exploit — $42 Million
The attacker used GMX V1’s keeper execution flow to access a temporary window in which leverage was enabled, then re-entered the vault to create unusually large short positions. Those positions manipulated the global short average price used in GMX’s AUM calculation, artificially inflated the price of GLP, and enabled approximately $42 million to be extracted through redemptions.
GMX demonstrates how keeper execution can become part of an exploit path. The keeper wasn’t compromised and didn’t execute an unauthorized transaction. The attacker exploited privileged protocol behavior that became available while the keeper was legitimately executing an order.
More commonly, keepers perform routine actions such as auto-compounding. In many liquidity and yield strategies, they periodically claim accumulated fees or rewards and submit transactions that reinvest them into the position.
Carbon DeFi provides native auto-compounding. Profits are automatically added back to the position as trades execute, without requiring an external bot to monitor the position or submit a separate compounding transaction.
Automation isn’t an additional service layered on top of Carbon DeFi. It is part of the protocol’s underlying execution logic. Removing keeper-based execution eliminates another external dependency and the operational risks that come with it.
