Solana-based decentralized crypto exchange Velocity (formerly known as Drift) says it rebuilt security after a $295 million hack. But its newly published audit doesn't examine the security layer attackers exploited to take control of Drift in the first place, The Coinformer found.
- The exchange, which emerged from Drift following the April exploit, published an OtterSec security review this week as it prepares to open its beta to everyone.
- OtterSec recorded 154 findings across Velocity's post-fork code, including 41 rated High and 109 Medium.
- None were Critical and Velocity says every High finding has been fixed in the deployed code.
But the review covers code, not every part of the system that can put user funds at risk.
"An audit reads code at a point in time. It does not cover the running deployment," Velocity says in its own documentation.
Attackers instead tricked members of Drift's Security Council into pre-signing transactions that were later used to transfer the protocol's admin authority to an attacker-controlled address, according to a threat report by blockchain infra firm Fireblocks.
With that control, the attackers could change protocol settings, approve fake collateral and drain real assets.
Velocity now says it has since overhauled those controls. Admin authority is now divided among cold, warm and narrowly scoped hot keys, alongside a separate pause key.
Routine changes can be timelocked, while the most sensitive authority is kept separate from keys used for day-to-day operations.
- The OtterSec report, therefore, provides an independent check of Velocity's rebuilt code, but it doesn't independently validate the full operational and signing setup designed to prevent another takeover like April's.
- Velocity says its operational security is being reviewed through STRIDE, a security program run by Asymmetric Research with the Solana Foundation.
Noah Prince, Velocity's head of protocol, told The Coinformer that the review covers the operational controls outside OtterSec's scope.
Noah Prince
- It remains unclear, however, whether Velocity's STRIDE report will be published or when.