Our initial analysis indicates that GMX’s order-keeper account (0xd4266f8f82f7405429ee18559e548979d49160f3) issued a transaction, which passes a contract address as the first parameter of executeDecreaseOrder, and then the attacker leveraged a reentrancy to carry out the attack.