Velocity's security cannot be assessed with the usual "list of PDF reports" template. The protocol is a fork of the Drift v2 codebase deployed as a new program with its own changes. The audit picture therefore splits into two independent parts: checks of the inherited pre-fork code and a review of Velocity's own post-fork changes. We present both — with a precise statement of what each document covers.
Additional context: the platform's previous incarnation, Drift Protocol, was halted after the April 1, 2026 hack. The attack vector was not a smart-contract bug but the compromise of privileged multisig signatures through the durable-nonce mechanism — and that mechanism has been removed from the new program entirely.
Audits of the inherited codebase (pre-fork Drift Protocol v2)
Both reports below were produced for the Drift v2 codebase before the fork point (commit 0ae3e3b1d). They cover the inherited core — the perpetuals engine, margin logic, the DLOB and the vAMM — but not the changes the Velocity team made after the fork.
Trail of Bits (November–December 2022)
A classic static-and-dynamic audit with full access to the source code. The review found no high-severity flaws affecting the confidentiality, integrity or availability of the system; in January 2023 Trail of Bits separately reviewed the implemented fixes. The report contains a detailed findings register broken down by severity.
Neodyme (May–June 2024)
An audit by a team specializing in Solana program security. Scope: protocol-v2; the report is dated May 10, 2024 with updates from June 27, 2024.
The review of Velocity's own code (post-fork): the OtterSec status
The only review covering Velocity's own changes: OtterSec examined the deployed program and the vaults program — including the VLP module, the fee-distribution redesign, the tiered cold/warm/hot/pause admin-key model, isolated pools, builder codes and the SWIFT signed-order path.
According to the protocol, the review produced a substantial set of High and Medium findings, all of which are fixed in the deployed program — the fixes are in the codebase, not on a roadmap. However, the final report has not been officially published: until it is, the public record consists of the migration notes in the monorepo, where each finding is cited by number next to the code that resolves it. We deliberately record this status: the report's publication is an event worth waiting for before judging the protocol's maturity.
Interim record: migration notes (GitHub) ↗
Recovery-plan requirements for the deployment
The relaunch deployment went through the recovery plan's controls: instruction-level auditing, timelocks on administrative actions and a review under STRIDE — Solana's ecosystem security program. In addition, the durable-nonce mechanism exploited by the attackers in April was removed from the program, and the single administrator was split into cold/warm/hot/pause tiers with recipient-locked protocol-fee withdrawals.
Bug Bounty: program terms
The bounty program follows the Immunefi v2.3 severity classification and covers the on-chain code and the web application (web payouts are capped at the High tier). Vulnerability reports are accepted only at [email protected] — creating public GitHub issues for security reports is explicitly prohibited.
| Severity | Impact type | Reward |
|---|---|---|
| Critical | Theft of funds without user signatures, irreversible freezing of assets | 10% of the hypothetical hack value, min $10,000, max $100,000 |
| High | Temporary freezing, incorrect allocation of funds | $2,000 – $10,000 |
| Medium | DoS, griefing, theft of small amounts under heavy preconditions | $500 – $2,000 |
| Low | Other issues outside the tiers above | $100 – $500 |
How to read fork audits: three questions
Velocity's story is a textbook case of why the marketing label "audited" always needs verification. Three questions to ask about any forked protocol's audit:
1. Which commit was reviewed? An audit is only valid for a specific snapshot of the code. The 2022 Trail of Bits and 2024 Neodyme reports describe Drift v2 before the fork point — they do not cover Velocity's VLP module, fee redesign or tiered keys.
2. Is the report published or merely claimed? A "all findings fixed" status without a published document is the protocol's statement, not a verifiable fact. A public PDF lets you verify the scope, severity and status of every finding yourself.
3. What changed in the privilege model? The April 2026 hack bypassed the audited code entirely — through compromised administrative signatures. For post-incident forks, timelocks, key separation and payout-recipient restrictions matter more than code reports.
Primary sources
The protocol's official audits page and the open repository of audit documents are the primary sources, updated as new materials — including the final OtterSec report — are published.
The Audits page in the Velocity documentation ↗