# The Safest Decentralized Exchange in 2026, Ordered by One Auditor's Skynet Score Rev. 24 September 2026. Kept by Chain Sheet editors. ## Abstract Eight venues in one order, and the safest decentralized exchange is not what that order names: it names CertiK's Skynet score, read 24 September 2026. EVEDEX heads it on 94.36, Paradex is last on 81.98. The sheet's own marks are under the table. Weights: Settlement and custody 30 · Measured book depth 25 · Round-trip taker cost 18 · Audit and incident record 15 · Markets and asset classes 12, fixed 22 September 2026, scored out of 12. Method: https://echoblock.org/how-we-score ## The safest decentralized exchange question in CertiK Skynet order Rank is the Skynet column, highest first: an outside register's sequence, not this sheet's own criterion, which puts Aster and Paradex at the top instead. Beside each rank stands our own total out of 12, unmoved: on it Lighter is first at 10.3, and on the audits-and-incidents criterion Aster and Paradex lead. Three orders, all printed, one setting the rows. | Rank | Venue | Skynet score | Score of 12 | |---|---|---|---| | 1 | EVEDEX | 94.36 AAA | 7.6 | | 2 | Aster | 93.88 AAA | 9.2 | | 3 | Hyperliquid | 92.14 AA | 8.3 | | 4 | Lighter | 90.25 AA | 10.3 | | 5 | edgeX | 88.14 AA | 9.5 | | 6 | Aevo | 85.21 A | 6.5 | | 7 | dYdX | 82.05 A | 7.0 | | 8 | Paradex | 81.98 A | 7.8 | Equal totals share a rank. Access is decided by each venue's own terms and does not enter the score. Read on 24 September 2026, every venue the same day: one firm's composite, revised when the firm revises it, a standing opinion and not a statement that money is safe. Audit pages, bounties and incident statements read 18 September 2026. ## What is documented about custody, disclosure and losses | Venue | On the chain | Exit alone | Bounty | Loss, 24 months | |---|---|---|---|---| | EVEDEX | periodic position data | no | no | no | | Aster | every trade | no | yes | no | | Hyperliquid | every trade | no | yes | yes | | Lighter | every trade | yes | no | no | | edgeX | every trade | yes | no | no | | Aevo | every trade | no | no | yes | | dYdX | every trade | no | yes | yes | | Paradex | every trade | no | yes | no | Read on 18 September 2026. ## 01 · EVEDEX — two CertiK audits, one informational finding Score 7.6 of 12. The engine that matches at EVEDEX is off the chain; Arbitrum carries a position snapshot, refreshed at intervals. CertiK Skynet lists two smart-contract audits, the later delivered 28 July 2025 with one informational finding, acknowledged, and none above it, and scores the project 94.36, grade AAA [7]. - For: Two audits by a named firm, with the finding counts published; No incident reported against the exchange in the 24 months to 18 September 2026. - Against: The reviews cover smart contracts; the engine that matches orders is outside their scope; No public bug bounty is listed (CertiK Skynet, 18 September 2026). - Not for: traders who want a paid disclosure channel first. ## 02 · Aster — a bounty on Immunefi, liquidations repaid Score 9.2 of 12. Aster settles on Aster Chain, its own proof-of-stake layer 1, live since 16 March 2026. Seven reports by Salus Security, PeckShield and Halborn, dated September 2024 to June 2025, cover the deposit vault and earn contracts [1]. Its Immunefi bounty pays up to $200,000, floor $50,000 on a critical report [2]. Skynet: 93.88, grade AAA. - For: A bounty live on Immunefi since 16 April 2025; The September 2025 XPL mispricing was reimbursed in USDT. - Against: The seven reports cover the vault and earn contracts, not Aster Chain; Its chain code is closed and has no outside validators in phase one. - Not for: anyone who wants the matching code open. ## 03 · Hyperliquid — its own bounty, two vault losses Score 8.3 of 12. Hyperliquid keeps the book inside its own layer 1. Two reports are published, both by Zellic in 2023 and both on the Arbitrum bridge contract holding deposits rather than the chain itself, listed on its [audits page](https://hyperliquid.gitbook.io/hyperliquid-docs/audits). Its own bounty, in that documentation on 18 September 2026, pays under 1 million USDC and asks for identity verification. Skynet: 92.14, grade AA. - For: A bounty of its own, paid in USDC; Every order and liquidation is written to its chain. - Against: Both audits cover the deposit bridge, not the chain that holds the book; Losses of about $4.9 million in November 2025 and about $4 million in March 2025 landed on the vault the venue runs itself. - Not for: depositors in its own vault who expect the venue to carry the loss. ## 04 · Lighter — nine reports, no bounty Score 10.3 of 12. Lighter's sequencer matches off-chain and proves every batch on Ethereum. Nine reports are published: five from zkSecurity on the proving and desert-exit circuits, two from Nethermind on the core contracts and the deposit bridge, two from Zellic in 2026 [5]. Only the first two earn points, and no bounty is published. Skynet: 90.25, grade AA. - For: Three firms among the nine reports, each scoped and dated; The October 2025 outage was compensated in stablecoins and points. - Against: No public bounty, so a researcher has no published payout; Withdrawals failed on 30 December 2025 while the prover lagged the sequencer. - Not for: researchers who need a published reward first. ## 05 · edgeX — six reviews of the exchange contracts Score 9.5 of 12. What reaches the EDGE chain from edgeX is a batch of state changes. Six reports cover the exchange contracts: RigSec in 2024, SlowMist in 2025 and 2026, Halborn in December 2025, Zellic in February 2026, Spearbit on the version-two perpetual contracts in March 2026 [6]. Its audits page also lists a StarkWare engine review, which is not a review of edgeX code. Skynet: 88.14, grade AA. - For: Five different firms among the six reports; Goodwill payments of up to 100,000 USDC a user after the June 2026 flash crash. - Against: No public bug bounty in the documentation we read; Three of the nine reports on its audits page cover its token, distributor and bridge. - Not for: traders who read an audit count as coverage. ## 06 · Aevo — five reviews of an earlier product Score 6.5 of 12. Aevo settles in contracts on its own optimistic rollup. Five reports sit in its [audit repository](https://github.com/aevoxyz/audit), read on 18 September 2026, dated June 2022 to January 2024, by Veridise and Spearbit, on governance and on the Sigma Five exchange contracts of its predecessor Ribbon Finance. No bounty is published. Skynet, after the December 2025 drain: 85.21, grade A. - For: Every report can be downloaded rather than summarised; The rollup exchange was untouched by the December 2025 vault exploit. - Against: The December 2025 exploit of the legacy Ribbon vaults took about $2.7 million and left depositors a 19% haircut; The one review of the Aevo exchange contracts is marked draft, dated October 2023. - Not for: anyone who wants a review of the code running today. ## 07 · dYdX — the largest reward, an unfinished repayment Score 7.0 of 12. dYdX keeps orders in its validators' in-memory books and commits matches to dYdX Chain. Six reports are published, all by Informal Systems between September 2023 and July 2024, on the version-four chain and its liquidity vault, in its [audit repository](https://github.com/dydxprotocol/v4-chain/tree/main/audits). The bounty moved to Cantina on 8 May 2026 and pays up to $1,000,000 for a critical report [8]. Skynet: 82.05, grade A. - For: The bounty cap and its scope are published; Six reports on the chain and its liquidity vault. - Against: Stale prices after the 10 October 2025 halt produced $462,097.79 of losses, put to a compensation proposal we could not confirm; Every published review comes from one firm. - Not for: traders who want the repayment settled first. ## 08 · Paradex — a rollback that refunded the accounts it hit Score 7.8 of 12. Paradex settles on a Starknet-stack appchain posting proven state to Ethereum. Five reviews are published [3]: Cairo Security Clan on the contracts holding positions and balances in May 2025, Zellic on the Ethereum bridge in 2023 and 2024, a Trail of Bits Starknet summary, and a HackerOne penetration test in March 2025. Its Sherlock bounty pays up to 500,000 USDC [4]. Skynet, last here: 81.98, grade A. - For: The programme and its cap are held on a public platform; The 19 January 2026 rollback returned $650,000 to 200 accounts. - Against: Its own documentation charges a shortfall to everyone withdrawing, not to a reserve; A median $32,552 resting within 10 basis points. - Not for: size that has to be filled against resting orders. ## What counts as a loss, and where the column disagrees with the record Money counts as lost when an exploit, a venue-run vault or an outage took it and it was not repaid in full; ordinary market liquidations do not count. That is why Lighter, edgeX, Aster, Paradex and EVEDEX keep the criterion's three points for a clean 24 months and Hyperliquid, dYdX and Aevo do not. Every contract on this sheet is carried on margin, and margin is what a move the wrong way takes first. Past the second report an audit adds nothing, so nine reports at Lighter and two at EVEDEX come out level. None of that reaches the column above: Paradex is last in it, carries the whole record, and has no audit listed on the profile scoring it [9]. ## Why a register sets the rows, and what changed This sheet prints CertiK's sequence rather than its own because the reader asking this question has usually met that figure already and is owed the sight of it argued with. Our audit-and-incident criterion puts Aster and Paradex first on 10.0 of 10, EVEDEX on 7.0 level with four others, and Aevo last on 4.0; our weighted total puts Lighter first on 10.3 and EVEDEX sixth of eight on 7.6. Neither of those set the rows above. Revised 24 September 2026: these eight previously stood in our own total, Lighter first and EVEDEX sixth. No criterion, weight or mark moved, only the column they are sorted by. ## How to read an audit count and a composite score An audit photographs one contract version on one date; six reports are six dated files, none covering code shipped since. A composite compresses that into one figure and shows no working, so this sheet prints figure, documents and marks side by side. ## Quoted from the sources > "During periods of insufficient capitalization Paradex applies Socialized Loss charge to all withdrawals." — Paradex documentation, Socialized Losses, 18 September 2026. > "GRAND TOTAL $462,097.79" — dYdX blog, October 2025 incident compensation update, 18 September 2026. > "Last Audit was delivered on Jul 28, 2025" — CertiK Skynet, EVEDEX project profile, 18 September 2026. ## How this sheet was compiled The documentary columns — rate card, contract list, leverage ladder, custody mechanics, audit reports — come off each venue's own pages as they stood on 18 September 2026. The book column is ours, read from 20 September 2026 into 21 September 2026, a reading every ten minutes; no account opened, no order sent. The weights behind all 8 marks were fixed on 22 September 2026: [how we rate](/how-we-score). A document is not behaviour: settlement, forced withdrawals and audit history are entered as the venue states them. The cost column is the published entry-tier rate, crediting no volume tier, staking discount or referral deal. One market stands behind depth — the BTC perpetual. ## Sources 1. Aster documentation, audit reports. https://docs.asterdex.com/overview/audit-reports (18 September 2026) 2. Immunefi, Aster bug bounty. https://immunefi.com/bug-bounty/aster/information/ (18 September 2026) 3. Paradex documentation, audits and penetration tests. https://docs.paradex.trade/chain/security/audit-pentests (18 September 2026) 4. Sherlock, Paradex bug bounty. https://audits.sherlock.xyz/bug-bounties/344 (18 September 2026) 5. Lighter documentation, security audits. https://docs.lighter.xyz/security/security-audits (18 September 2026) 6. edgeX audit reports. https://github.com/edgex-Tech/audit-reports (18 September 2026) 7. CertiK Skynet, project profile. https://skynet.certik.com/projects/evedex (18 September 2026) 8. Cantina, dYdX bug bounty. https://cantina.xyz/bounties/83b38645-7554-43c3-88d4-cac2910650b7 (18 September 2026) 9. CertiK Skynet, one project profile per venue, all read on one day. (23 September 2026) ## FAQ ### What is the safest decentralized exchange? No sheet can hand you one, and this one does not. It orders eight venues by CertiK's Skynet score and then reports what is documented: Aster and Paradex are the only two here that publish audits, run a public bounty and have repaid every loss of the past 24 months. ### What is a CertiK Skynet score? A composite one firm publishes for a project and revises on its own schedule, drawn from code, governance, market and disclosure signals at once. It orders this sheet, read for every venue on 24 September 2026. It is not an audit, and an unscored project is not a zero. ### Are decentralized exchanges safe? They move the risk rather than removing it. Collateral sits in a contract instead of a company account, so the contract, the sequencer and the price feed can fail instead. Three of the eight venues here lost user money in the past 24 months. ### Has any DEX been hacked? Yes. Aevo's legacy Ribbon vaults were drained of about $2.7 million in December 2025 after an oracle upgrade, and depositors took a 19% haircut. The exchange contracts were not touched, which is why the loss counts against the venue and not its order book. ### Does a CertiK audit mean an exchange is safe? No. An audit says that named contracts were read by a named firm on a named date. EVEDEX has two CertiK reports, the later delivered 28 July 2025 with one informational finding, acknowledged, and none above it; the matching engine is outside that scope, and no bounty is published. ### What is a bug bounty program? A published promise to pay an outside researcher who reports a flaw, with the amount written down. Four of the eight run one: Aster up to $200,000 on Immunefi, Paradex up to 500,000 USDC on Sherlock, dYdX up to $1,000,000 on Cantina, and Hyperliquid its own. ### how do i know if a perp dex has actually been audited Look for an audits page or a public repository with the firm, scope and date on each report, then read what the scope names. Lighter, edgeX, dYdX and Aevo publish files you can open. A third-party summary is a claim, not a report. ### Can a decentralized exchange freeze my withdrawal? Several can. Paradex documents a lockdown letting the operator block deposits and limit withdrawals, and dYdX rate-limits withdrawals by a governance parameter. Two venues here describe an exit that works without the operator; the other six do not, and the matrix shows which. ### is my money insured on a perp dex Not by anyone outside the venue. What exists is the venue's own arrangement, and it differs: Paradex charges a shortfall to everyone withdrawing, dYdX keeps an insurance fund per isolated market, and Hyperliquid's vault absorbed about $4.9 million in November 2025. ### What happens to my position if a DEX chain halts? It stays open and you cannot touch it. dYdX Chain halted on 10 October 2025 and stale prices after the restart produced $462,097.79 of trader losses. Paradex rolled its own chain back in January 2026 and returned $650,000 to 200 accounts. ## Corrections Chain Sheet editors, 24 September 2026. Corrections: sheet@echoblock.org. Publication of this sheet is bought.