Drift Protocol audit reports and smart-contract security
⚠️ Critical notice: Security incident (April 2026)
Please be aware that in April 2026 Drift Protocol suffered a large-scale hack in which the platform lost a significant amount of user funds. At the moment, the protocol's operations are suspended.
It is important to note that analytics showed the hack was not caused by a classic smart-contract vulnerability (which auditors could have caught), but by a compound failure in operational security (OpSec), including the compromise of multisig-wallet processes and improper use of the durable nonces mechanism on Solana. This incident is a stark reminder: passing a code audit (even by Tier-1 firms) does not guarantee the complete security of a protocol's entire ecosystem.
Below are the historical audit opinions Drift obtained between 2022 and 2024, prior to the incident. This material is strictly for research purposes.
Before the 2026 incident, Drift Protocol was considered one of the most technically advanced decentralized perpetual futures exchanges on the Solana blockchain. Given the sheer complexity of the V2 codebase — including a hybrid AMM, JIT liquidity auctions and a cross-margin lending mechanism — the team engaged the industry's leading cybersecurity firms to validate its smart contracts (programs).
The audit architecture: Trail of Bits, Neodyme and Zellic
Trail of Bits (Core DEX audit)
From November to December 2022, the prestigious firm Trail of Bits (TOB), known for its work with Google and Microsoft, conducted a comprehensive white-box audit of Drift Protocol. The auditors combined static and dynamic testing to search for vulnerabilities that could compromise data integrity or contract availability. The review found no high-severity flaws at that time.
Neodyme (Drift V2 and economic engine audit)
From February to April 2024, the audit firm Neodyme focused on the most intricate module — the Margin Calculator. The audit uncovered one critical finding related to an incorrect calculation of fees paid to "crankers" (order keepers), which in theory could have allowed funds to be gradually drained from the protocol. The Drift development team promptly fixed the issue before the update was deployed to mainnet.
Zellic (Architecture audit)
Additionally, Drift Protocol underwent an independent review by the firm Zellic. The report is published in their official GitHub repository and covers verification of the AMM curve math, resilience to Pyth oracle manipulation, and the correctness of position risk metrics (Health factor).
Official security reports (Historical archive)
The links lead to official documentation repositories and auditors' repositories.
| Component / Protocol | Auditor | Vulnerability summary (TL;DR) | Original reports |
|---|---|---|---|
| Drift DEX & Smart Contract Solana Core Architecture |
Trail of Bits | Audited (2022-2023). Verified resilience to attacks on integrity, confidentiality and availability. All discovered Medium issues were handled by the team. | Report |
| Drift V2 Program Cross-Margin & Liquidations |
Neodyme | Resolved (2024). One critical vulnerability found in the cranker reward logic. The bug was fixed and the patch validated by Neodyme before deployment. | Report |
| Drift Protocol Logic AMM & Oracle Integration |
Zellic | Audited. Full economic-security analysis of the hybrid order book. | Report |
Education hub: Lessons from the 2026 hack and OpSec
The April 2026 Drift incident fundamentally changed the industry's approach to DeFi risk assessment. It clearly demonstrated that a smart-contract audit is no longer a sufficient security measure. Systems become vulnerable outside the blockchain.
Smart Contract Security
This covers what auditors do (Trail of Bits, Neodyme): hunting for code bugs, precision-loss errors, incorrect account checks (AccountInfo validation in Solana Anchor) and reentrancy vulnerabilities.
Operational Security (OpSec)
What hurt Drift. Compromise of privileged keys (admin keys), missing or insufficient Timelock periods for critical upgrades, social engineering and centralized dependencies.
Recovery status and monitoring
The Drift DAO is currently working on a restructuring plan and compensation for affected users (Recovery Pool). Any potential relaunch of the protocol would require entirely new audits from independent firms (including OtterSec) and a complete overhaul of key-management security.
Track Drift's status on CertiK Skynet