$1,000,000 in security audit grants are live now, Apply here →
Get a quote

← Resource Hub

Perp DEX Audit Checklist: 40 Checks for Perpetual Exchanges

By the Guardian team Updated 5 min read

Perp DEX Audit Checklist: 40 Checks for Perpetual Exchanges

Quick answer. A perpetual DEX audit should test every price path, funding and fee math, margin, liquidation and ADL, order execution, keepers, LP vault accounting and admin parameters. Each of the 40 checks below links to a public Guardian finding.

Watch: Perp DEX Audit Checklist: 40 Checks for Perpetual Exchanges 1:40
Video transcript

A perpetual DEX audit should test every path where value moves. Here are the checks that matter, each tied to a public Guardian finding.

The checklist spans forty checks: price and fee math, margin and liquidation, auto-deleveraging, order execution, keepers, and LP and admin settings.

Every trade and funding payment reads a price, so the math must be exact. At Perp City, one trade after an idle period could set the funding rate.

Initial margin must apply to every exposure increase. Leverage limits must count unrealized losses, and liquidations must never revert on edge cases.

ADL runs in the worst minutes. On October 10, 2025, Hyperliquid's ADL closed 2.1 billion dollars of positions in 12 minutes, per a paper by Gauntlet CEO Tarun Chitra.

Pool-based perps fill orders after they are placed. Any way to choose when, or whether, an order fills is a free option on price.

Guardian pairs a manual team and an AI-driven team over invariant fuzzing. Core rules: pool assets cover reserved liabilities, long and short open interest match, and zero collateral means zero debt.

In Synthetix's BFP Market review, the rule that keeper fees never exceed lost collateral broke. It was one of 5 of 51 invariants that did not hold.

Read the full article for all forty checks, or talk to Guardian about a Vanguard audit.

Our guide to perp DEX security maps where perpetual exchanges get attacked. This is the auditor's side: what a review should actually test.

The findings come from Guardian's public reports for GMX, Synthetix, MUX, Ethereal, Perp City, PariFi and Veranta (formerly Avantis).

Use it to scope a review, or work through it before one.

Price and Fee Checks

Every trade, liquidation and funding payment reads a price. Fees are then charged on it, so both paths need exact math.

Oracle and mark price

  1. Signed price payloads cover every field, including the exponent (GMX, High).
  2. Staleness is checked per feed, not from the payload header (Veranta, High).
  3. User actions carry a mark price bound and a deadline, not only AMM slippage (Perp City, High).
  4. Health checks account for any gap between the mark and the price positions settle at (Perp City, High).
  5. TWAP writers are gated and observations spaced, so no one can skew the window (Perp City, High).

Funding and fees

  1. Funding collected equals funding distributed, in the same units (GMX, High).
  2. A single trade after an idle period cannot set the funding rate (Perp City, High).
  3. Funding that an insolvent payer never pays is not pulled from LP capital (Veranta, High).
  4. Settling fees never resets a position's funding checkpoint (GMX, Critical).
  5. Every close path, including partial take-profits, applies the right fee (Veranta, High).
  6. Fees credited to the collector are actually collected from the user (Ethereal, Critical).
  7. No zero-fee route reaches the same result, such as a shift instead of a deposit (GMX, High).

Margin, Liquidation and ADL Checks

Margin checks decide who can add risk. Liquidations and ADL remove it before it turns into bad debt.

Margin and liquidation

  1. Initial margin applies to every exposure increase, not only new positions (Perp City, Critical).
  2. Leverage limits count unrealized losses, not just stored collateral (Veranta, High).
  3. Liquidation checks include pending price impact as well as PnL and fees (GMX, High).
  4. Liquidations cannot revert on edge cases, such as fees larger than PnL (PariFi, High).
  5. Settling an order cannot leave an account instantly liquidatable (Synthetix, High).
  6. Accounts with exposure across several markets liquidate as one position (MUX, High).

ADL and bad debt

ADL is the last resort, and it runs in the worst minutes. On October 10, 2025, Hyperliquid's ADL closed $2.1 billion of positions in 12 minutes, per a paper by Gauntlet CEO Tarun Chitra.

Its December 2025 version put unnecessary haircuts on winning traders at about $653 million. A February 2026 revision cut that estimate to $45.0 million to $51.7 million.

Hyperliquid's Jeff Yan rejected the critique, saying ADL does not transfer PnL to its HLP vault, Protos reported. He has argued ADL net made users hundreds of millions of dollars.

  1. ADL triggers on the whole position, not one pool's share of it (MUX, Medium).
  2. ADL reads its own threshold, not the general PnL cap (GMX, Medium).
  3. Refreshing ADL state cannot stall pending ADL orders (GMX, Medium).
  4. Bad-debt sharing includes uninsured losses in its claim base (Perp City, High).
  5. Insurance payouts reconcile the solvency accounts they draw from (Perp City, High).

Execution and Keeper Checks

Pool-based perps fill an order some time after it is placed, the model our GMX V2 explainer walks through.

Any way to choose when, or whether, an order fills is a free option on price.

Order execution

  1. An order that keeps reverting cannot later fill at its creation price (GMX, Critical).
  2. Users cannot block cancellation to hold an order open until price moves (GMX, Critical).
  3. Stop-losses still execute when price gaps through the trigger (GMX, High).
  4. A take-profit report binds the position size it priced (Veranta, High).
  5. Liquidation swaps carry a slippage bound for the liquidated account (Perp City, High).

Keepers and offchain services

Most of these live outside the contracts. Guardian covers them in an offchain automation pentest.

  1. Keepers are paid for every action, including cancellation callbacks (GMX, High).
  2. External calls during execution cap gas and survive malformed return data (GMX, Critical; Ethereal, High).
  3. Offchain services keep prices as integers end to end, never as floats (Ethereal, High).
  4. Signed API actions cover every payload field (Synthetix, High).
  5. Ops scripts read storage the way the contracts do (GMX, High).

LP and Admin Checks

In pool-based perps, LPs take the other side of every trade. Admin parameters set the limits that protect them.

LP vault accounting

  1. Pool value excludes the impact pool and the fee receiver's share (GMX, Critical; High).
  2. The first deposit cannot be stolen with a donation (MUX, Critical).
  3. Unrealized trader losses cannot let LPs withdraw past full utilization (MUX, High).
  4. Deposits and withdrawals cannot be arbitraged between two PnL caps (GMX, Critical).

Admin and parameters

  1. Every risk parameter can actually be set through config (GMX, Critical).
  2. Each market has an open interest cap, so reserves cannot trap LPs (GMX, High).
  3. Risk changes, such as ADL thresholds, give traders a grace period (MUX, Medium).

How Guardian Audits Perp DEXs

Guardian's audits run two competing teams on the same scope, one manual and one AI-driven, over an invariant fuzzing suite.

Five solvency invariants from Guardian's public perps reports:

  • Pool assets always cover reserved USD (MUX).
  • No position's PnL exceeds the pool's assets (MUX).
  • Long open interest equals short open interest (Ethereal).
  • Zero collateral means zero debt (Synthetix).
  • No one earns more in keeper fees than the collateral they lose (Synthetix).

The last one broke for margin-only liquidations in Synthetix's BFP Market round 2 review. It was one of 5 of that report's 51 invariants that did not hold.

Vanguard adds a $100,000 Defender contest and six months of update review. Compare firms in Best Perp DEX Auditors, or read Guardian's GMX case study.

Frequently Asked Questions

What should a perpetual DEX audit check?

Every price path, funding and fee math, margin and liquidation, ADL and bad-debt handling, order execution timing, LP vault accounting and admin parameters. Keepers and trading backends need their own offchain review.

What is funding rate manipulation?

Funding moves value between longs and shorts based on skew and time. Manipulation means timing trades or updates to tilt those payments. At Perp City, Guardian found one trade after an idle period could set the funding rate.

How do auditors test auto-deleveraging?

They check that ADL triggers on whole-position PnL, reads its own threshold and cannot be stalled by state refreshes. Then they follow each shortfall into the insurance fund and bad-debt accounts, and check those balances reconcile.

Which invariants should a perp DEX fuzz?

Solvency rules. Pool assets cover reserved liabilities, and no PnL exceeds pool assets. Long and short open interest match, zero collateral means zero debt, and no one earns more in keeper fees than the collateral they lose.

Sources

Run this checklist with Guardian

Guardian audits perp DEX contracts, keepers and trading backends, with an invariant suite built around your solvency rules.

Get a quote Explore Vanguard