We manage your security to weather the AI storm →
Get a quote

Perp DEX smart contract audit

A perpetual exchange pays out on prices it reads from outside, through keepers that act unattended. Guardian audits the contracts, the keepers and the math between them, with 80+ engagements on GMX alone.

Get a quote Read the GMX story
80+ GMX engagements
173 Criticals and Highs found for GMX
13,279 Lines of Guardian tests in GMX's repo
22 Criticals and Highs on Veranta V2
140M+ Fuzzing runs on Synthetix BFP

DeFi audits for

  • GMX
  • Synthetix
  • Orderly Network
  • Dolomite
  • Veranta
  • Olympus

Onchain · Perp DEX Audit

Every price, every position, every payout.

  • Oracles and price feeds Every signed field, decimals and exponents, per-feed staleness, fallbacks, and execution prices that postdate the order.
  • Funding and borrowing Funding paid equals funding received, across skew flips and idle periods, with debt corrected on every path.
  • Price impact Impact pools, caps and rebates, and whether split, merged or sequenced orders escape the penalty.
  • Open interest and liquidity limits OI caps sized to real depth, reserves that cover trader PnL, and caps that withdrawals can push below open positions.
  • Margin and liquidations Margin on every exposure change, liquidations nothing can block, and self-liquidation for profit.
  • Auto-deleveraging and bad debt ADL triggers, position selection and sizing, insurance fund flows, and who absorbs a shortfall.
  • Keepers and order execution Who can execute, when and at what price: gas limits, callbacks, cancellations and free options.
  • Fee and PnL accounting Each fee charged once, partial closes, PnL settlement, referral and keeper fees, and rounding direction.
  • Vault and LP accounting LP share pricing with pending trader PnL, deposit and withdrawal symmetry, first depositors and redemption queues.
  • Multichain and cross-margin Bridged deposits and orders, message ordering, token spoofing, and collateral shared across markets.
  • Upgrades and admin keys Roles that list markets, set oracles and change risk parameters, with their thresholds and timelocks.
  • Listing and delisting The runbooks and scripts that open and wind down markets, checked step by step against the contracts.

Covers oracle-priced pools, order books with onchain settlement, and leveraged-token designs on Ethereum, L2s and HyperEVM. Keepers and trading backends are reviewed alongside, in an Offchain Automation Pentest.

Get a Perp DEX Audit

Public findings

What Guardian has found in perps code.

Each card links a finding in a public Guardian report. All were resolved.

  1. C-01Veranta V2 · Critical

    The Pyth Lazer parser never checked that a signed update carried an exponent. Read as zero, it priced a normal feed 100 million times too high, and the inflated funding became collateral withdrawable from the LP vault.

    Oracles Read the finding C-01 in the Veranta V2 report

  2. C-03Synthetix BFP · Critical

    Reported debt used only unrecorded funding as the next funding entry, misstating the funding still owed to and from traders.

    Funding Read the finding C-03 in the Synthetix BFP Market report

  3. C-05Synthetix BFP · Critical

    Merging a large order into a small account erased its fill-price penalty, so anyone with capital could farm the skew incentive.

    Price impact Read the finding C-05 in the Synthetix BFP Market report

  4. H-06Veranta V2 · High

    LP withdrawals could push a pair’s cap below its open interest. Fee math then reverted, blocking closes and liquidations.

    Open interest Read the finding H-06 in the Veranta V2 report

  5. C-01GMX V2.1 · Critical

    A gas adjustment for an external call that never happened made autoCancel cancellations revert, leaving those positions unliquidatable.

    Liquidations Read the finding C-01 in the GMX June 2024 updates report

  6. H-05Umami · High

    GMX’s auto-deleveraging returned native ETH to a WETH vault that counted only WETH, so its share price jumped.

    ADL Read the finding H-05 in the Umami GMX V2 Position Manager report

  7. GLOBAL-1GMX · Critical

    Chainlink keepers sent 5 million gas per execution. Orders with callbacks, and deposits with four or more swaps, needed more, so the keepers could not run them.

    Keepers Read the finding GLOBAL-1 in the GMX Chainlink Automation report

  8. C-02Veranta V2 · Critical

    A partial close charged the whole position’s fees to the closed slice, then reset the rest. Closing 0.100001 USDC wiped 63.42 USDC of borrow fees.

    Fees and PnL Read the finding C-02 in the Veranta V2 report

  9. C-01GMX GLV · Critical

    Above the PnL cap, GLV valued GM tokens differently on deposit and withdrawal, so an attacker could mint low and redeem high. Fuzzing caught it.

    LP vaults Read the finding C-01 in the GMX GLV report

  10. C-02GMX V2.2 · Critical

    Bridged tokens and the message recording them arrive in two steps. A permissionless lzCompose let anyone act between them and take the deposit.

    Multichain Read the finding C-02 in the GMX V2.2 Crosschain, Part 1 report

  11. LCMU-1Orderly · Critical

    setTokenDecimal had no access control, so anyone could set decimals per chain and turn 1 WETH into 10 on another chain.

    Admin functions Read the finding LCMU-1 in the Orderly Perpetuals Protocol report

Onchain · How it runs

Two teams, and solvency written as code.

  1. 01 / Two teams

    Two independent teams, one scope.

    Team A pairs expert manual review with the fuzzing suite. Team B runs Helix across every corner. On Veranta V2, both teams found the Lazer oracle flaw on their own.

    • Expert manual review
    • Competitive incentives
    • Cross-checked findings

  2. 02 / Helix AI Auditor

    Helix, the leading AI Auditor.

    Hundreds of parallel agents spend billions of tokens across the entire codebase. Only human-verified findings reach the report.

    • Billions of tokens
    • Human-guided context
    • Human-triaged findings

  3. 03 / Invariant fuzzing

    An invariant suite around your solvency.

    Core safety properties become executable invariants, fuzzed across every reachable state. On a perp DEX, those are its solvency rules.

    • Zero collateral means zero debt
    • Open interest within its cap
    • Liquidation checks never revert

  4. 04 / Keepers and backend

    The offchain half, at the same time.

    Keepers and order engines are read against the contract math they mirror, with a fuzzing harness that turns drift into a failing property.

    • Order execution and liquidations
    • Signed-price and API services
    • Keeper and contract drift

The suite stays with your code for every later change. GMX runs 13,279 lines of Guardian tests in its CI, and Synthetix kept the Echidna harness from its BFP Market review: 22 invariants, more than 140 million runs.

Get a Perp DEX Audit

Published work

Perpetual exchanges Guardian has reviewed.

Hyperliquid and HyperEVM

Contracts built on Hyperliquid.

Recent incidents

The failures a perp DEX audit tests for.

  1. $285MDrift

    Attackers got two of five council signers to pre-sign transactions. With no timelock, they took admin control, listed their own token as collateral and withdrew real assets.

    Apr 2026 Our breakdown of the Drift incident

  2. $13.5MHyperliquid HLP

    HLP inherited a trader’s JELLY short as spot buys on thin DEX markets pushed the price up. Its unrealized loss reached $13.5 million before validators delisted JELLY.

    Mar 2025 Our coverage of the JELLY incident

  3. $7.5MKiloEx

    A forwarder behind the price feed accepted forged signatures. The attacker set ETH to $100, opened longs, then set it to $10,000.

    Apr 2025 Our coverage of the KiloEx incident

“Guardian has been an integral part of the growth of GMX and our ecosystem of protocols who also rely on them for audits. Having Guardian as a strategic partner has allowed us to move more quickly while keeping security as our highest priority.”
CoinflipcanadaGMX
“Some of the best auditors we have worked with. The team is very prompt with communication, their domain expertise in DeFi, specifically derivatives, is unparalleled.”
Slava GerashenkoOrderly Network

Resource Hub

Before you book a perps audit.

Questions

Perp DEX audit questions

What does a perp DEX audit cover?

The contracts that price, margin, fund, liquidate and settle positions, the LP vault, admin roles, and the scripts that list and delist markets. Keepers, relayers and order engines get an Offchain Automation Pentest at the same time, so issues that cross both halves are caught.

Which invariants do you fuzz on a perp DEX?

Solvency rules. Synthetix’s BFP Market report lists “isPositionLiquidatable never reverts” and “If an account’s collateral is 0, then the account’s debt must also be 0”. In MUX’s report, “Total open interest in USD for a market must not exceed its configured cap” failed under fuzzing.

Do you audit Hyperliquid and HyperEVM protocols?

Yes. Guardian’s public reports cover Bounce Tech’s leveraged tokens on Hyperliquid perps, Nunchi’s genesis vaults and nLP migration, and Valantis’s stHYPE staking modules. These are protocols built on Hyperliquid. For the risks of the chain itself, see Is Hyperliquid Safe?

Our code is already audited. Is another review worth it?

Veranta’s V2 contracts had two audits before Guardian’s. Reviewing last, on code that carried the second firm’s fixes, Guardian reported 4 Criticals and 18 Highs, more than the two earlier reports combined, including a fee bug an earlier report had marked resolved.

Can you review a design before it is built?

Yes. GMX brought Guardian its V2.3 cross-margin plan before writing the code, then its architecture decision records before implementation. Settling whether a design is needed at all costs far less before the code exists.

What do we get at the end?

Human-verified findings with proof-of-concept tests, a review of your fixes, and the invariant suite, which stays with your code. GMX merged Guardian’s tests into its own repository, where they run in CI on every change.

Smart Contract Audit

Other engagements

Start now

Get a quote for your perp DEX audit.

Get a quote