Orderly Network security record
As of 20 Oct 2026, Orderly Network has 10 audit reports by 4 security firms on Trustblock; the latest is by Guardian Audits, dated 22 Nov 2025. Those reports list 1 critical acknowledged and not fixed.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits10
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Orderly Solana Vault audit | Security firm: Guardian Audits | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Orderly Solana Staking audit | Security firm: Guardian Audits | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Orderly Strategy Vault audit | Security firm: Zellic | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Orderly Strategy Vault audit | Security firm: Guardian Audits | Date: | Scope: Not recorded (see the report) | 7 critical findings, fixed | Open · GitHub |
| Orderly audit (July 2024) | Security firm: Guardian Audits | Date: | Scope: Not recorded (see the report) | 5 critical findings, fixed | Open · GitHub |
| Orderly OFT audit | Security firm: Guardian Audits | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Orderly Network security assessment | Security firm: Zellic | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Orderly audit (October 2023) | Security firm: Guardian Audits | Date: | Scope: Not recorded (see the report) | 1 critical acknowledged, not fixed | Open · GitHub |
| Orderly audit (July 2022) | Security firm: Halborn | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Orderly Network | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
Findings252
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 16 |
| High | 1 | 7 | 16 |
| Medium | 1 | 29 | 42 |
| Low | 3 | 58 | 78 |
HighCentralization Related RisksOrderly Network · CertiK · 16 Sep 2022Open
Smart contracts on the Near blockchain are deployed in accounts backed by regular key pairs. Therefore, the overall security of a smart contract is related to the proper use and safekeeping of such key pairs. Trading users deposit a wide range of assets used for trading into the `Asset Manager` contract. As a result, the contract locks up a significant amount of funds. Therefore, any compromise of the `Asset Manager` contract account could allow a hacker to use this power to steal funds that would otherwise remain in the custody of the contract. Further, the following roles are also sensitive as they contain significant authority over core functionality. In the file, `[contract.rs]`, the role `[fee_collector]` has authority over the following functions: - `fee_collector_withdraw()` In the file, `[owner.rs]`, the role `[owner]` has authority over the following functions: - `set_approver_request_possible()` - `set_approver()` - `set_owner()` - `set_operator_manager()` - `set_only_authorized_access()` - `add_authorized_account()` - `remove_authorized_account()` - `set_withdraw_verify_key()` - `set_trade_verify_key()` - `set_symbol_listed()` - `set_token_listed()` - `set_token_delisted()` - `remove_listed_symbol()` - `set_fee_collector()` In the file, `[Operator.rs]` the role, `[operator]` has authority over the following functions: - `operator_execute_action()` - this allows for privileged access to uploading trades or operator withdrawing. In the file, `[Approver.rs]` the role `[approver]` has authority over the following functions: - `approve_owner()` - `approve_operator()` - `approve_fee_collector()` - `approve_new_approver()` - `approve_approver_request_persmission()` - `approve_symbol_listing()` - `approve_symbol_delisting()` - `approve_token_listing()` - `approve_token_delisting()` - `approve_withdraw_verify_key()` - `approve_trade_verify_key()` - `approve_autorized_access()`
Open the reportMediumInsufficient Validation In withdraw2ContractOrderly Strategy Vault audit · Guardian Audits · 24 Feb 2025Open
The report gives no description here.
Open the reportLowCancelAllVestingRequests Can Still Be SubmittedOrderly Solana Staking audit · Guardian Audits · 21 Mar 2025Open
The report gives no description here.
Open the reportLowContracts Lack Withdraw FunctionsOrderly Solana Staking audit · Guardian Audits · 21 Mar 2025Open
The report gives no description here.
Open the reportLowMissing Check For Duplicated TradeOrderly Network · CertiK · 16 Sep 2022Open
The role `operator manager` account is responsible for uploading trades generated by the off-chain matching engine program. The structure `TradeUpload` in `types.rs` is used to store the information about the uploaded trades. For the information present in the contracts, the field `trade_id` identifies a unique trade. There is no restriction in the code that prevents the same trade from being uploaded more than once. Therefore, the balance of the user in the "Asset Management" contract will be increased/decreased multiple times for the same single trade.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="orderly-network"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us