Audits
The three reports covering Velocity and the codebase it forked from: who reviewed what, what they found, and where to read each one.
Three reports cover the code behind Velocity. OtterSec audited Velocity's own program after the fork, and the Drift Protocol v2 codebase it forked from carries two earlier audits, by Trail of Bits and by Neodyme. All three are linked below.
Post-fork: Velocity
OtterSec
OtterSec audited the Velocity program between June 19th and July 20th, 2026, and issued the final report on September 3rd, 2026. The review covers everything Velocity added after the fork, which is the surface neither earlier report reaches.
The report separates its results into advisories, which have immediate impact and are meant to be remediated, and suggestions, which do not. It produced 154 findings in total: no Critical, 41 High, 109 Medium, 1 Low and 3 Informational. Every High finding is fixed in the deployed code.
OtterSec: Velocity Protocol v2 Security Assessment
Final report, September 3rd, 2026. PDF, 382 pages.
Pre-fork: Drift Protocol v2
Velocity forked Drift Protocol v2. Both reports in this section were performed on that codebase, so they describe the inherited base and not the deployed program. Neither covers anything added or changed since the fork.
Trail of Bits
Drift Protocol engaged Trail of Bits to audit its exchange and its onchain program. The review ran from November 7th to December 2nd, 2022, with full knowledge of the target system, including source access and documentation, and used a mix of automated and manual static and dynamic testing. It reported no high-severity flaws in the confidentiality, integrity or availability of the exchange.
Trail of Bits then re-reviewed Drift's fixes and mitigations between January 23rd and January 25th, 2023. The findings still unresolved or partially resolved after that pass are listed on page 73. View the full report here.
Neodyme
Neodyme reviewed the same pre-fork codebase. The report was authored on May 10th, 2024 and last updated on June 27th, 2024. View the full report here.
What an audit does not cover
An audit reads code at a point in time. It does not cover the running deployment: the keys that can change parameters on a live market are a separate surface, documented in Admin keys. Risks covers what that means for an open position, and Bug bounty is the route for reporting anything these audits did not catch.