Safest Perp DEX (2026)

How the security score is built

PerpFinder's security score combines four factors: number of independent audit firms, audit recency, on-chain vs off-chain settlement model, and incident history. A score of 9.0+ requires multiple audits from recognized firms, no exploits since launch, and on-chain settlement for positions and margin.

dYdX scores 9.2/10 — the highest among venues you can actually trade on today. It has audits from Trail of Bits, PeckShield, and Informal Systems, and the Cosmos SDK foundation underneath the dYdX Chain has been battle-tested across dozens of production blockchains with billions in total staked value. (Kwenta, which shared this score historically, wound down after the Synthetix perps sunset and no longer qualifies for the security ranking — its review is kept as history.)

GMX has published work from ABDK, Sherlock, and Guardian Audits. Its operating history started in September 2021. Review each audit scope and the current protocol controls before you deposit funds.

What the score does not capture

Oracle risk. GMX uses Chainlink references, while dYdX validators use market price inputs. A bad or delayed price input can cause an incorrect fill or liquidation. Some contract audits do not cover every price source or market-control process. The March 2025 JELLY event on Hyperliquid involved manipulation in a low-liquidity market rather than a contract exploit. A single security score cannot show every part of this risk.

Sequencer centralization. Several high-scoring venues use off-chain order matching with on-chain settlement. Off-chain matching means the sequencer operator can technically front-run orders or manipulate fill ordering. The on-chain settlement audits verify the accounting is correct — they do not audit the matching engine. Fully on-chain order books like Hyperliquid's eliminate this trust assumption at the cost of throughput constraints.

Audit age. An audit from 2021 on code that has been updated five times since is weaker than a recent audit on the current codebase. PerpFinder notes audit recency in the individual protocol pages — check /perps/gmx and /perps/dydx for specific dates and scope.

A worked risk assessment

For a $50,000 position held for two weeks on a top-security venue:

- Smart contract exploit risk: Low (multiple audits, no historical exploits) - Oracle manipulation risk: Medium (present for all oracle-based venues, managed by circuit breakers) - Sequencer front-running risk: Low for fully on-chain, Medium for hybrid off-chain matching - Chain-level risk: Low for dYdX Chain (Cosmos, active validator set), Medium for Base/Arbitrum deployments (sequencer centralization)

The dYdX security model is the most documented of any venue in PerpFinder's coverage set. The documentation describes the validator set, slashing conditions, and emergency governance mechanics in detail.

Skip this page if...

You are optimizing primarily for fees. The highest-security venues charge 4.5-6 bps taker. The lowest-fee venues (Lighter at 0 bps, DESK at 1.75 bps) carry lower security scores because they are newer with shorter track records and fewer audits. Security and fees trade off at the margin. Decide which risk matters more for your position size.

Also skip this if you are trading small amounts where smart contract risk is not material relative to market risk. For a $500 trade, the probability-weighted expected loss from a contract exploit is negligible. For a $500,000 position, the security score becomes genuinely decision-relevant. Use the cost comparison tool to see fee costs across all security tiers, and the full perp listing for complete audit details.