Best Perp DEX Auditors in 2026

Video transcript

A perp DEX holds trader collateral, prices positions from oracles and relies on keepers to liquidate. A flaw in any of the three can drain it.

Guardian publishes this guide and ranks itself first. We used only public evidence: perps reports, depth on major venues, offchain scope and methods.

Guardian leads with 77 public perps reports for 11 clients, including GMX, Synthetix, Orderly and Veranta, formerly Avantis.

Zellic follows, then Sherlock, best for contests on perps code. Pashov Audit Group, Trail of Bits, OtterSec and Certora complete the top seven.

GMX's docs name Guardian its primary auditor. Guardian has reviewed every GMX contract update since October 2022, across more than 80 engagements.

Each area here has a public Critical or High in Guardian's perps reports: oracles and prices, funding and fee math, and liquidations, which two GMX Criticals could stop.

On GMX V2, keepers execute every order and liquidation, in code a contract audit does not read. Guardian's GMX keeper review returned 55 findings, eight of them High.

Vanguard puts two independent teams on your contracts: manual review with invariant fuzzing, and Helix, Guardian's AI auditor. For perps, the invariants are solvency rules. A one hundred thousand dollar Defender contest follows, and keepers get an offchain automation pentest.

Read the full guide for sources and the scope checklist, or talk to Guardian at guardian.security about your perp DEX.

Disclosure: Guardian publishes this guide, and we ranked ourselves first. Claims about other firms come from their public report repositories and the audit pages of the venues they reviewed, with sources at the end.

A perp DEX holds trader collateral, prices positions from oracles and relies on keepers or bots to liquidate. A flaw in any of the three can drain it.

Much of that risk sits in the math: funding, price impact, margin and bad debt. Much of the rest sits offchain, in the services that decide what executes.

This guide ranks the firms with the most public perps work. For the attack surface itself, see Perp DEX Security.

How We Ranked Perp DEX Auditors

We used only public evidence, on four criteria:

1. Public perps reports. Reports for perps venues we could read, in the firm’s repo or the venue’s docs.
2. Depth. Primary-auditor roles and repeat reviews of the same venue.
3. Offchain scope. Keepers, order engines, relayers and price services.
4. Methods. Fuzzing, formal verification and contests on top of manual review.

Perp DEX Auditors Compared

The Top Perp DEX Auditors

1. Guardian

• Perps record: 77 public reports for 11 clients, with 129 Critical and 278 High findings
• Basis: the Perpetuals filter of Guardian’s portfolio on November 5, 2026, including Veranta’s October V2 review
• Clients include: GMX, Synthetix, Orderly, Veranta (formerly Avantis), MUX, Ethereal, Perp City and PariFi

GMX’s docs name Guardian its primary auditor. Guardian has reviewed every GMX contract update since October 2022, across more than 80 engagements.

It also reviews the offchain half: GMX’s keeper service and Avantis’s trading backend, alongside their contracts.

2. Zellic

• Perps record: public reports for Avantis, Drift, Ostium, Orderly, Perennial and GTE Perps
• Also: Hyperliquid’s legacy bridge contract, per Hyperliquid’s docs

Veranta names Zellic, Guardian and Sherlock as its three V2 auditors.

3. Sherlock

• Perps record: public contests for GMX, Perennial, JOJO, Perpetual Protocol v3, Elfi and Orderly
• Also: audited Avantis v1.5, per Veranta’s docs

GMX’s docs list Sherlock for GMX Synthetics updates. Its contest repos are public on GitHub.

4. Pashov Audit Group

• Perps record: six team reviews for Gains Network’s gTrade, five for Ostium and seven for Reya
• Venues: gTrade’s leveraged trading and Ostium’s RWA perpetuals on Arbitrum

Its full reports, findings included, are public on GitHub.

5. Trail of Bits

• Perps record: Drift Protocol (2022) and Perpetual Protocol V2
• Drift: a review of the exchange from November 7 to December 2, 2022, then a fix review

6. OtterSec

• Perps record: Jupiter Perpetuals, per Jupiter’s docs, alongside Offside Labs and Sec3
• Recent: the 2026 audit of Velocity, a fork of Drift Protocol v2

Velocity’s docs report 154 findings, none Critical, with every High fixed in deployed code.

7. Certora

• Perps record: GMX Synthetics (November 2023) and Aftermath Finance Perpetuals (2026)
• Known for: formal verification, proving that specified rules hold for every input

What a Perps Audit Must Cover

Each area below has a public Critical or High in Guardian’s perps reports.

Oracles and prices

• Exponents: an omitted Lazer exponent inflated an oracle price (Veranta, Critical).
• Staleness: perp markets accepted stale beacon prices (Perp City, High).
• Timing: GMX’s first V2 review found a Critical in same-block pricing for limit orders.

Funding and fees

• Synthetix’s BFP Market miscalculated funding in its reported debt (Critical).
• A GMX funding factor was open to manipulation (High).

Liquidations, ADL and insurance

• Two GMX Criticals could stop liquidations, leaving underwater positions open.
• On Veranta, LP withdrawals could block liquidations (High).
• Orderly’s ledger duplicated an insurance transfer amount (Critical).

For the patterns behind these, see liquidation vulnerabilities and oracle manipulation.

Offchain Keeper and Frontend Scope

Perp contracts rarely act alone. On GMX V2, every trader request waits for a keeper to price and execute it.

A keeper defect can stop the exchange outright, or execute the wrong thing at the worst moment. A contract audit will not see it.

Guardian’s GMX keeper review returned 55 findings, eight of them High. All eight Highs were resolved, and most sat where the keeper’s view of a position disagreed with the contracts.

Its Avantis backend review covered the relayer, order and TWAP engines, risk engine and APIs. Both Criticals were fixed during the review.

Put these in scope:

• Keepers and bots: what each key can call, and what a skipped run does
• Order engines and relayers: who can submit what on whose behalf
• Price services: staleness, deviation limits and signed-price checks
• Frontend and APIs: the domain, DNS and app that users sign through

How Guardian Audits Perps

Vanguard puts two independent teams on your contracts: manual review with invariant fuzzing, and Helix, Guardian’s AI auditor. Only human-verified findings reach the report.

For perps, the invariants are solvency rules: margin, funding, fees and bad debt. On Synthetix’s BFP Market, Guardian ran over 140 million fuzzing runs against 22 invariants.

A $100,000 Defender contest, a hosted bug bounty and six months of update review follow. For keepers and backends, Guardian runs an offchain automation pentest.

Building on Arbitrum? See the best Arbitrum auditors.

Frequently Asked Questions

Who audits GMX?

GMX’s docs name Guardian its primary auditor: eight engagements from October 2022 to September 2023, then every update since. ABDK, Certora, Dedaub and Sherlock have also audited GMX Synthetics.

What should a perp DEX audit cover?

Oracle handling, funding and fee math, margin, liquidations and auto-deleveraging, the insurance fund and order execution. Then the offchain half: keepers, order engines, relayers and price services.

Should keepers and trading backends be audited?

Yes. On GMX V2, keepers execute every order, liquidation and deleveraging. Guardian’s review of GMX’s keeper service returned 55 findings, eight of them High, in code a contract audit does not read.

How long does a perp DEX audit take?

It depends on scope. Guardian reviewed Orderly in two weeks in 2023 and MUX in five weeks in 2025. GMX V2 had eight engagements over eleven months before launch.

Sources

• GMX Docs: Security
• Veranta: Audits
• Hyperliquid Docs: Audits
• Jupiter Developers: Audits
• Velocity Protocol: Audits
• Zellic: Publications (GitHub)
• Sherlock: GMX Update contest repository (April 2023)
• Sherlock: Perpetual contest repository (February 2024)
• Sherlock: Contest repositories (GitHub)
• Pashov Audit Group: Audits (GitHub)
• Trail of Bits: Publications (GitHub)
• Certora: Security Reports (GitHub)
• Guardian: GMX client story
• Guardian: GMX keeper review case study
• Guardian: Avantis offchain review case study
• Guardian: Synthetix BFP Market case study
• Guardian: Orderly case study
• Guardian: Audit portfolio