dYdX
DAMASCUSPerps DEX · dYdX Chain (Cosmos) · $500M+ TVL · 10 contracts
Public risk assessment — scores are produced with the same methodology as monitored protocols
Security Profile
76
82
75
78
72
85
46
82
78
76
82
75
78
72
85
46
82
78
Audit History
Bug Bounty Program
Assessment
Downgraded from MITHRIL (859) after 26 adversarial findings including 8 Criticals. Chain halt vectors (OOM, Price=0, negative fee panic) demonstrate systemic fragility in consensus-layer validation. ClobPairIdFilter bypass is a direct access control failure enabling fund theft. D7 calibrated against euler_v2 (81 findings, D7=41), reserve (100 findings, D7=40), lido (38 findings, D7=44) using v1.1 severity-weighted formula.
Dimension Breakdown
How scores work →- Cosmos-based chain with validator set
- Smart contract bridge to Ethereum
- Governance controls protocol parameters
- Operator permissions for market creation
- ClobPairIdFilter bypass: authenticator ACL on trading sub-keys can be circumvented, enabling full account drain from restricted keys
- Orderbook model proven at scale
- Insurance fund for socialized losses
- Liquidation engine well-tested
- Fee structure transparent
- Custom oracle system for perpetual pricing
- Multiple data sources aggregated
- Oracle committee for price submission
- Centralized oracle trust assumption
- V3 live since April 2021, V4 since October 2023
- Largest perpetual DEX by volume
- Survived multiple market events
- Chain migration demonstrates operational capability
- DYDX token governance via Cosmos chain
- Foundation controls significant parameters
- Governance participation growing
- Migration from Ethereum added complexity
- 3 low-severity and 1 informational finding
- Critical vectors: chain halt (OOM via MinNumVotesPerSample, Price=0 market creation, negative fee panic), ClobPairIdFilter bypass (full account drain)
- Source: BlackHart adversarial sprint May 2026
- Professional trading infrastructure
- 24/7 monitoring
- Validator coordination
- Incident response demonstrated
- Standalone chain reduces external composition
- Bridge to Ethereum adds cross-chain risk
- Limited DeFi composability by design
- Validator set dependency
- Cosmos SDK based
- Standard Go/Solidity stack
- Verified Ethereum contracts
- Custom trading engine
Additional Dimensions
- Not assessed — excluded from BRI computation
Risk Drivers
Primary risk factors driving this score, ordered by severity.
Adversarial Risk Signals
Observable security posture indicators. These signals reflect publicly verifiable information and responsible disclosure outcomes. No specific vulnerability details are exposed.
Score History & Verification
Score provenance tracking begins with the next reassessment.
On-Chain Data
- Protocol Slug
- "dydx"
- Oracle
- BRORegistry (Base)
- Evidence
- IPFS (pinned)
- Staleness Threshold
- 24 hours
registry.getScore("dydx")Reduce exploitable risk
BlackHart Monitoring provides continuous adversarial analysis, vulnerability detection, remediation support, and verified reassessment when your risk posture improves.