October 4, 2023

Dive Into The dYdX Chain Audit

dYdX
Dive Into The dYdX Chain Audit

Introduction

Ensuring the safety and security of the dYdX Chain software is our top priority. That’s why we are extensively testing and auditing the code to make sure that user funds are always safe. Today, we’re sharing that Informal Systems has fully audited the dYdX Chain code and all findings have been addressed by the dYdX team. Dive into the audit below.

Details of the Audit

Informal Systems implements a multi-layered, automated approach to their security audits and is well-versed in security for the Cosmos Ecosystem. They audited the dYdX Chain code in three phases.

Phase I covered:

  • Custom modules: x/assets, x/perpetuals, x/epochs, x/sending, x/prices, x/subaccounts,
  • Liquidation and price-feed daemons
  • Custom changes to forked versions of CometBFT and Cosmos SDK.

Phase II covered:

  • Custom modules: x/clob
  • Custom changes to forked versions of CometBFT and Cosmos SDK.

Phase III covered:

  • Custom modules: x/bridge, x/delaymsg, x/rewards, x/vest
  • Bridge Daemon
  • Additional custom changes to the forked version of CometBFT.

All phases of the audit are complete and we’re proud that zero critical issues currently exist within the dYdX Chain source code. The audit surfaced 1 critical issue (that is now resolved), 4 medium issues, 17 low issues and 19 informational issues. 34 of those issues were accepted and 5 issues were functioning as designed.

Thank you

Thank you to Informal Systems for their thorough audit and their commitment to help us ensure the safety and security of the dYdX Chain. We’re also hosting a bug bounty for the dYdX Chain software with payouts up to $5,000,000 depending on severity and eligibility. Any issues brought up in the audit or otherwise known by the dYdX team are not eligible for the bug bounty, and other terms and conditions apply. See the details here.

Find Informal Systems on Twitter, Github, and LinkedIn.

About dYdX and Terms

Here at dYdX, our mission is to democratize access to financial opportunity. We believe that v4 software will represent notable progress in service of that mission. The events in the global economy that have transpired over the last year have only reinforced the need for open, transparent, and permissionless financial products. We’re excited for v4 software to better meet those needs.

If building the future of a decentralized exchange and open finance is something you’re interested in, check out what it’s like to work at dYdX and our open roles!

To ask additional questions, join the discussion on Discord, participate in the dYdX community, or follow us on Twitter. We’re excited to continue building the dYdX Chain and will continue to release updates over the coming months.

Terms and Conditions: This post is subject to the dYdX Terms of Use.  The dYdX interface and products are not available to persons or entities who reside in, are located in, are incorporated in, or have registered offices in the United States or Canada ("Blocked Persons"), or other Restricted Persons (as defined in the dYdX Terms of Use). dYdX products and services are not intended for, and should not be used by, Blocked Persons or Restricted Persons. Terms of Use specific to v4 software can be found here.

Resources
Help CenterBlogAcademyMarketsBrandTerms of UsePrivacy Policy
Ecosystem
dYdX LabsdYdX FoundationdYdX Operations subDAOdYdX Grants subDAOIntegrate
Legacy Product
ExchangeCommunity
© 2025 dYdX Foundation. All rights reserved.

dYdX is a decentralised, disintermediated and permissionless protocol, and is not available in the U.S. or to U.S. persons as well as in other restricted jurisdictions. The dYdX Foundation does not operate or participate in the operation of any component of the dYdX Chain's infrastructure.

Nothing in this website should be used or considered as legal, financial, tax, or any other advice, nor as an instruction or invitation to act in any way by anyone. You should perform your own research and due diligence before engaging in any activity involving crypto-assets due to high volatility and risks of loss.

Depositing into the MegaVault carries risks. Do your own research and make sure to understand the risks before depositing funds. MegaVault returns are not guaranteed and may fluctuate over time depending on multiple factors. MegaVault returns may be negative and you may lose your entire investment.

The dYdX Foundation does not operate or has control over the MegaVault and has not been involved in the development, deployment and operation of  any component of the dYdX Unlimited software (including the MegaVault).

Crypto-assets can be highly volatile and trading crypto-assets involves risk of loss, particularly when using leverage. Investment into crypto-assets may not be regulated and may not be adequate for retail investors. Do your own research and due diligence before engaging in any activity involving crypto-assets.