Derive security record
As of 30 Oct 2026, Derive has 6 audit reports by 2 security firms on Trustblock; the latest is by Sigma Prime, dated 1 Mar 2025. Those reports list 1 critical acknowledged and not fixed. It also holds 8 deployed contracts on 4 chains.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits6
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Atomic security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Derive security review Audit · firm’s term: security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | 1 critical acknowledged, not fixed | Open · GitHub |
| Audit Report | Security firm: Paladin | Date: | Scope: 8 addresses on 4 chains | No open critical findings | Open · paladinsec.co |
| Pptsa security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Derive security review Audit · firm’s term: security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | 4 critical findings, fixed | Open · GitHub |
| V2 Matching security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings47
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 4 |
| High | 0 | 1 | 7 |
| Medium | 0 | 4 | 7 |
| Low | 2 | 11 | 10 |
CriticalBids Can Be Blocked By Sending Option To LiquidatorDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportCriticalDenial-of-Service (DoS) During Manager Health Checks Affects Liqui- dationsDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportCriticalFunds can be Drained from the Protocol by Liquidating an Account Dur- ing an Asset TransferDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportCriticalLiquidator Can Bid With Insufficient CashDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportHighWithdrawals Can Be Forcefully Initialised By AnyoneDerive security review · Sigma Prime · 1 Jan 2025Fixed
The report gives no description here.
Open the reportHigh_authorizeUpgrade is not permissionedAudit Report · Paladin · 20 Nov 2024Fixed
The report gives no description here.
Open the reportHighBurning of deriveToken will fail, resulting in loss of fundsAudit Report · Paladin · 20 Nov 2024Fixed
The report gives no description here.
Open the reportHighUsers can mint as many voting units as they want to themselvesAudit Report · Paladin · 20 Nov 2024Fixed
The report gives no description here.
Open the reportHighAccount Can Be Created With Arbitrary Manager AddressDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportHighFully Liquidated Auctions Cannot Be TerminatedDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportShow 10 more
HighProcessing Non-Existent Withdrawal RequestsV2 Matching security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportMediumSignatures Can Be Reused To Undo RevocationAtomic security review · Sigma Prime · 1 Mar 2025Fixed
The report gives no description here.
Open the reportMediumsmFeePercentage Not Cached Properly When Socialised Multiple TimesDerive security review · Sigma Prime · 1 Jan 2025Fixed
The report gives no description here.
Open the reportMediumAssets Can Be Transferred After Auction StartedDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportMediumChecks-Effects-Interactions Pattern Violations In BaseTSA ContractV2 Matching security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportMediumDouble-Spent Deposits Can Lead To Under-Collateralised TSAV2 Matching security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportMediumFailed Token Transfers Will DoS WithdrawalsV2 Matching security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportMediumSession Key Deregistration Cooldowns can be AvoidedDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportLowPotential For Setting lbtsaParams.leverageCeil Equal To lbtsaParams.leverageFloorAtomic security review · Sigma Prime · 1 Mar 2025Fixed
The report gives no description here.
Open the reportLowEIP-712 Compliance IssuesDerive security review · Sigma Prime · 1 Jan 2025Fixed
The report gives no description here.
Open the reportShow 8 more
Lowredeem can have a duration greater than maxRedeemDurationAudit Report · Paladin · 20 Nov 2024Fixed
The report gives no description here.
Open the reportLowThe default values for several variables will not be applicableAudit Report · Paladin · 20 Nov 2024Fixed
The report gives no description here.
Open the reportLowCritical Assumptions May Break Intended PPTSA ProtectionsPptsa security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportLowDust Asset Amounts Can Amplify Gas CostsDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportLowId Can Overflow In Loop Causing DOSDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportLowOpen Spread Loss Calculation ErrorPptsa security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportLowPotential DoS Risk In Derive Protocol Due To Unbounded LoopDerive security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportLowRFQ Fee Calculation ErrorsPptsa security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportContracts8
| Address | Chain | Source code |
|---|---|---|
| 0xc3d960b2d0a1d23b1d2073293fc80625d7fa1fbc | Chain: Optimism | Source code: Verified source |
| 0x7499d654422023a407d92e1d83d387d81bc68de1 | Chain: Ethereum | Source code: Verified source |
| 0xc3d960b2d0a1d23b1d2073293fc80625d7fa1fbc | Chain: Base | Source code: Verified source |
| 0x7499d654422023a407d92e1d83d387d81bc68de1 | Chain: Optimism | Source code: Verified source |
| 0xc3d960b2d0a1d23b1d2073293fc80625d7fa1fbc | Chain: Ethereum | Source code: Verified source |
| 0x7499d654422023a407d92e1d83d387d81bc68de1 | Chain: Base | Source code: Verified source |
| 0x7499d654422023a407d92e1d83d387d81bc68de1 | Chain: Arbitrum | Source code: Verified source |
| 0xc3d960b2d0a1d23b1d2073293fc80625d7fa1fbc | Chain: Arbitrum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="derive"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us