Audits
Velocity is a fork of Drift Protocol v2 (fork point 0ae3e3b1d). The audits below were performed on the pre-fork Drift Protocol v2 codebase that Velocity forked from, not on Velocity’s own program deployment or its new/changed functionality (the VLP module, the fee redesign, tiered admin keys, and other features added or changed since the fork). OtterSec’s post-fork review of Velocity’s own program deployment has delivered a large set of High and Medium findings, and the fixes for them are already in the codebase. The final report has not been published yet. Until it is, the migration notes are the interim record of what OtterSec found and how each finding was fixed. The final report will be published on this page once it is finalised. See the migration guide for a developer-facing summary of what changed since the fork.
The record below is in two parts: two audits of the pre-fork Drift Protocol v2 codebase, and one review of Velocity’s own post-fork program.
Pre-fork (Drift Protocol v2)
Trail of Bits
Overview
Drift Protocol engaged Trail of Bits (TOB) to audit the security of its decentralized exchange and smart contract.
From November 7 to December 2, 2022, the TOB team conducted a security audit of Drift Protocol’s decentralized exchange. TOB’s testing efforts were focused on the identification of flaws that could result in a compromise of confidentiality, integrity, or availability of Drift’s decentralized exchange and smart contract. The audit was conducted by TOB with full knowledge of the target system, including access to the source code and documentation. TOB utilized a mix of static and dynamic testing of the target system and its codebase, using both automated and manual processes.
Audit Result
The audit did not uncover any high-severity flaws that could impact system confidentiality, integrity, or availability. After the initial audit findings, between January 23 and January 25, 2023, Trail of Bits reviewed the fixes and mitigations implemented by Drift Protocol to resolve the issues described in this report.
A summary of outstanding findings is shown below.
A full listing of unresolved or partially resolved findings can be found on page 73 of the TOB Audit Report (Report). The undetermined finding relates to Testing code used in production and is described in further detail on page 77 of the Report.
View the full report here .
Neodyme
Scope: protocol-v2
Authored: May 10th 2024
Last Updated: June 27th 2024
View the full report here .
Post-fork (Velocity)
OtterSec
Scope: the Velocity program and the vaults program, as deployed by Velocity after the fork. This is the only review that covers Velocity’s own changes, including the VLP module, the fee redesign, the tiered cold/warm/hot/pause admin key model, isolated pools, builder codes, and the signed-message (swift) order path.
Status
The review delivered a large set of numbered High and Medium findings across the two programs. Every one of them is fixed in the codebase; the fixes are in the deployed program, not pending. The final report has not been published yet.
Interim record
Until the report is published, the migration notes are the public record: their change log lists the audit-fix work alongside the rest of the fork’s changes, and individual findings are cited by number in the program source next to the code that resolves them. The report will be linked from this page once it is finalised.