Perp DEX security track record: days without a recorded exploit, live
Days each perp DEX has operated without a recorded security exploit, counted live from a versioned incident registry sourced from rekt.news and public post-mortems. Higher means a longer clean track record. Oracle-priced venues with immutable smart contracts have a structural advantage: there is no custodial hot wallet and no privileged admin key that can drain the vault.
TL;DR. As of , gains.trade leads days since last exploit at 1,708 (24h) on Perp DEX security track record: days without a recorded exploit, live. Source: OpenChainBench, https://openchainbench.com/benchmarks/perp-protocol-longevity.
Read this carefully
This benchmark counts recorded incidents only. Absence from the registry does not prove a protocol is exploit-free: it means no incident matching the criteria (direct theft or loss of user funds via a security vulnerability) has been documented in the tracked sources as of the registry timestamp shown on each row. The registry is human-curated and updated when a new incident is confirmed. The registry date and source links are embedded in the harness.
Smart contract exploits are the tail risk that every DeFi protocol carries. For a perp DEX the consequences are asymmetric: a single reentrancy or oracle manipulation event can wipe all liquidity from the vault while positions are still open. The DeFi ecosystem has a public, reasonably comprehensive ledger of these events in rekt.news and community post-mortems. This benchmark converts that ledger into a live counter: how many days has each venue operated without a recorded security exploit that resulted in direct theft or loss of user funds via a protocol vulnerability. gains.trade has been live since December 2021, more than four years, with no recorded exploit in the tracked sources as of the registry date. GMX had an exploit in July 2025 estimated at around 42 million USD via a reentrancy vulnerability. Hyperliquid, dYdX v4, Lighter and Paradex have no recorded protocol exploits. The harness computes the counter live each day from a versioned YAML registry committed to the harness repository. The registry is semi-automated: a daily job polls rekt.news for new entries matching the venue slugs and alerts a maintainer to confirm before committing. The counter therefore reflects confirmed incidents, not unverified reports.
Methodology
The harness maintains a versioned incident registry (registry.yaml embedded in the binary at build time). For each venue the registry holds the protocol launch date and a list of confirmed security incidents with date, estimated loss in USD, incident type and source URL. The live counter is (current_timestamp - max(launch_date, last_incident_date)) / 86400 in days. A venue with no incidents uses the launch date as the start of the clean streak. The harness emits three gauges per venue: perp_protocol_days_clean (the live counter), perp_protocol_incidents_total (count of recorded incidents), and perp_protocol_incident_amount_usd (cumulative USD lost in recorded incidents). The registry includes only incidents that resulted in direct theft or permanent loss of user funds via a protocol vulnerability. Oracle price manipulation without smart contract compromise, market-structure events (liquidation cascades, governance disputes) and front-end phishing are excluded and noted separately in the per-venue formula tooltip.
Frequently asked
What counts as a recordable incident?
Direct theft or permanent loss of user funds via a documented smart contract vulnerability or privileged key compromise. Oracle price manipulation events that do not involve a contract exploit are excluded. Market-structure events such as liquidation cascades triggered by large positions are excluded. The registry source URL for each entry is available in the harness YAML.
Why does gains.trade have such a long clean streak?
gains.trade launched in December 2021 and has not had a recorded exploit in the tracked sources as of the registry date, giving a streak of over four years. The synthetic architecture uses oracle pricing (no custodial AMM vault that can be drained) and immutable smart contracts without privileged admin keys on critical paths, which removes the most common attack surfaces.
Why is Hyperliquid's JellyJelly event not counted?
The March 2025 JellyJelly event was a market-structure incident: a large whale position was force-closed by the validator committee after a liquidation cascade threatened the insurance fund. No smart contract vulnerability was exploited and no user funds were stolen via a protocol bug. The methodology excludes market-structure events to keep the metric focused on smart contract security.
Does a long streak prove the protocol is safe?
No. A long clean streak is a positive signal and the best available public evidence of resilience under live conditions. It does not prove the code is exploit-free. Undiscovered vulnerabilities can exist for years before being found. The streak should be read alongside the protocol's audit history and architecture, not as a standalone guarantee.
How often is the registry updated?
A nightly job polls rekt.news and other public sources for entries matching the tracked venue slugs and raises an alert for manual review. A maintainer confirms and commits any new incidents, triggering a harness rebuild. The registry timestamp is visible in the harness source at registry.yaml.
Does this benchmark cover all historical incidents?
The benchmark covers incidents recorded in rekt.news and publicly disclosed post-mortems for the specific protocol deployments tracked. Incidents on predecessor versions (GMX v1, dYdX v1/v2), front-end phishing attacks and incidents on third-party integrations built on top of these protocols are out of scope.
Source code github.com/ChainBench/OpenChainBench/tree/main/harnesses/perp-protocol-longevity