- DFX+55Positive
Velocity (@VelocityDEX)
Velocity completes Audit with OtterSec. The protocol is now open source, leaner, and safer. Velocity today published the OtterSec audit of its protocol and opened the protocol’s source code. Everything built since the fork has been externally reviewed with no critical findings, and every high finding is fixed in the deployed code. The beta opens to everyone in the coming days. Openness and transparency are the standards the exchange reopens on. The report is available for anyone to view, and the source code is on GitHub, including the fixes from the review. “Trust is earned. We build in the open, as every DeFi protocol should; the on-chain economy should not be a black box. While we build in the open, every change that reaches users will be audited by an outside firm before reaching mainnet.” Noah Prince, Head of Protocol. The review Velocity worked with the team at OtterSec to review all work done post-fork after the April incident. The report separates advisories that might have an immediate impact and must be remediated from suggestions. It recorded 154 findings in total, none of which were critical. Velocity fixed every high finding in the deployed code, and the report also shows the resolution for each finding. When Noah Prince joined Velocity as Head of Protocol in June, one of Velocity’s immediate priorities was to complete the protocol's security and code review and reshape the protocol and systems to be leaner and more decoupled, so future audit work and feature releases can be faster and safer. The OtterSec review is the outside check on the work post-fork, with Asymmetric Research reviewing operational security alongside it and former Gauntlet security researchers helping mitigate risk and strengthen controls. A leaner open-source protocol The protocol is simplified to focus on perpetuals, with spot markets serving as collateral and borrow-lend. The external interface stays largely the same, so market makers and integrators can keep working without changes. Operational security, rebuilt Admin control is now separated into tiers, each with its own multisig: a cold admin for program upgrades, with external security parties among its signers; a warm admin for program parameters; a pause admin that can halt the program in an incident; and low-risk hot wallets for bots and cranks. The pause key can only add pauses, never remove them. Every signer uses a dedicated signing device, critical multisigs are time-locked, every proposal and approval raises an alert to the team, and sensitive admin actions are bounded by guardrails in the program itself. Fees, and where they go Every perpetual product fee now splits three ways among protocol liquidity, the Insurance Fund, and Velocity protocol itself. The Insurance Fund is owned entirely by its stakers. For DFX holders, that ledger is the plumbing under the recovery pool: a majority share of net protocol revenue goes to the recovery pool on the tiered schedule outlined in the DFX update. What comes next The exchange is now undergoing the Solana Foundation's STRIDE security review, and it has updated its operational security controls with Asymmetric Research. Stay tuned for the next update as we prepare to open the Velocity beta to everyone. Trade, Hedge, Earn at Velocity.Exchange. One account for everything: crypto and equity perps on one multi-collateral balance that earns while it backs your trade. Settled on-chain, in USDT. Backed by Tether.