Smart Contract Audits

​

Responsible Disclosure

If you discover a security vulnerability in Ostium’s smart contracts, please report it through Ostium’s Immunefi bug bounty program. Do not publicly disclose the vulnerability before giving the team time to investigate and remediate.

​

Audit Summaries

​

Zellic

Who: Zellic is a smart contract audit firm specializing in DeFi security reviews and vulnerability research. Audits: Two engagements. An initial audit in February 2024 covering the original Ostium architecture, and a follow-up audit in November 2025 reviewing the upgraded trading contracts ahead of the Jump Liquidity Upgrade. Scope: Both engagements covered core trading, vault, and liquidation contracts: trading execution, position settlement, fee calculations, and oracle price handling. The November 2025 review focused on the contract changes underpinning the post-JLU architecture. Key Findings: No critical vulnerabilities identified in either engagement. The reviews confirmed proper implementation of collateral management, fee accrual mechanics, and liquidation logic. Recommendations from the initial audit were addressed in subsequent contract updates. Download Zellic Audit Report: November 2025 (PDF) Download Zellic Audit Report: February 2024 (PDF)

​

ThreeSigma

Who: ThreeSigma is an independent security research firm focused on DeFi protocol audits and risk analysis. Audit Period: Conducted from February 19 to March 22, 2024. Scope: Secondary audit of trading contracts, OLP vault mechanics, rollover fee calculations, and position closure logic, complementing Zellic’s earlier review. Included static analysis and dynamic testing across all major execution paths. Key Findings: No critical or high-severity vulnerabilities. ThreeSigma confirmed correct implementation of variable fee structures, proper handling of leverage constraints, and appropriate liquidation threshold enforcement. All recommendations have been addressed or are slated for future upgrades. Download ThreeSigma Audit Report (PDF)

​

Pashov Audit Group

Who: Pashov Audit Group operates a network of 40+ vetted security researchers with deep experience in perpetual instrument protocols and oracle-driven pricing. Audits: Three security reviews: January 2025, April 2025, and January 2026. The January 2026 review specifically covered the post-JLU architecture (new vault settlement flow, daily reconciliation between onchain and offchain books, dynamic open-interest caps) ahead of the April 2026 mainnet upgrade. Scope: The January 2025 review covered core trading and vault contracts. The April 2025 review focused on oracle integration, price verification, and updates to liquidation automation following mainnet deployment feedback. The January 2026 review covered 13 core contracts (including OstiumVault, OstiumOpenPnl, OstiumTradingCallbacks, OstiumTrading, OstiumTradingStorage, OstiumPriceRouter, OstiumPairInfos, and related libraries) with five reviewers over a one-week engagement. Key Findings: All three reviews confirmed no critical vulnerabilities. The January 2026 review identified one high-severity finding affecting share-price accounting (operation ordering in the trade-close callback causing potential PnL double-counting between settlements) which was resolved before the JLU mainnet launch, plus two medium and eight low-severity findings, with eight resolved and three formally acknowledged. Pashov verified correct implementation of oracle price feeds (Chainlink and Stork), liquidation automation via Gelato Functions, and secure handling of collateral across all three engagements. Download Pashov Security Review: January 2025 (PDF) Download Pashov Security Review: April 2025 (PDF) Download Pashov Security Review: January 2026 (PDF)

​

Mainnet Contract Addresses (Arbitrum)

All contracts below are verified on Arbiscan and can be inspected at any time to confirm code integrity:

​

Testnet Contract Addresses (Arbitrum Sepolia)

The following contracts are deployed on Arbitrum Sepolia for development and testing:

​

Ongoing Monitoring

All Ostium smart contracts are continuously monitored for anomalies in fund flows, liquidation execution, and oracle prices. Any unexpected behavior triggers immediate investigation and, if necessary, protocol safeguards.

​

Verifying Contract Code

All mainnet and testnet contracts are fully verified on Arbiscan and Arbitrum Sepolia Explorer. To verify a contract:

1. Navigate to the contract address on Arbiscan (mainnet) or Sepolia Explorer (testnet)
2. Click the “Code” tab
3. Compare the displayed source code against the Ostium GitHub repository
4. Confirm the compiler version and optimization settings match the audit reports

This ensures transparency and allows anyone to independently audit the deployed code.

​

FAQ

What's covered by these audits?

All six audits cover the core trading and vault smart contracts: position opening and closing, liquidation logic, fee accrual, oracle pricing integration, and settlement flow. The post-JLU Pashov review (January 2026) specifically covered the new vault settlement architecture. Frontend code (the Ostium web app) and offchain hedging infrastructure are not in scope. The audits focus on the smart contracts where user funds are held.

How can I verify the contracts?

All contracts are verified on Arbiscan. Navigate to any contract address listed above, click “Code,” and inspect the source. You can also clone the Ostium GitHub repository and compare the code directly.

What if a vulnerability is later discovered?

Ostium Labs monitors the protocol continuously and maintains relationships with top security researchers. If a vulnerability is discovered post-audit, the team will assess severity and implement a remediation plan (contract upgrade, market freeze, or emergency measures) depending on risk level.

​

What to Read Next

• How Ostium Works — Two-layer architecture and the four core services that run the protocol.
• Vault Overview — Onchain settlement layer and two-tranche structure underpinning trader collateral.
• Markets — All 71 trading pairs with leverage caps, fees, and trading hours.