How Does Paradex Work?
Paradex is a ZK-STARK perpetuals exchange operating as a Starknet AppChain (the 'Paradex Chain'), offering cross-margin and portfolio-margin futures on 85+ pairs with up to ~100x leverage. Launched in October 2023 and incubated by Paradigm, Paradex peaked at $226M TVL in January 2026 and has since declined to $39.5M. Its C- grade reflects multiple structural centralization risks that L2Beat independently rates as 'Bad': encrypted state data availability controlled by a 3-of-3 Privacy Council, a fully centralized sequencer with no censorship resistance, and instant contract upgrade capability with no timelock. A May 2025 audit found 2 Critical and 4 High vulnerabilities, all of which were fixed before the report was published.
TVL
$40M
Sector
Derivatives
Risk Grade
C-
Value Grade
D+
Core Mechanisms
ZK / STARK Proof System
NovelStwo prover (Circle STARKs, M31 field) — first production deployment of Stwo
Paradex migrated from Stone prover to Stwo prover in November/December 2025, the first production deployment of Stwo's Circle STARK proof system using the M31 field. Stwo reduces proof generation from minutes to seconds. The novel cryptographic primitives (M31 field arithmetic) have no prior production track record — regression testing and formal verification are critical.
Data Availability / Encrypted External DAC
NovelEncrypted state diffs on Ethereum EIP-4844 blobs with 3/3 Privacy Council decryption
Paradex posts encrypted state differences to Ethereum as blobs but requires all three Privacy Council members to provide decryption keys for the state to be reconstructable. No other major perp DEX uses this DA model. L2Beat rates this 'Bad': a small set of entities can collude with the proposer to finalize an unavailable state, causing fund loss.
Derivatives / Perpetual Futures
Cross-margin, isolated-margin, and portfolio-margin (SCAN) perpetuals on 85+ pairs
Standard perpetual futures with funding rates. Cross-margin shares USDC collateral across all positions. Portfolio Margin (beta) uses SPAN/SCAN risk scenario methodology to reduce margin requirements. Only USDC accepted as collateral.
Exchange / Hybrid Order Book
Off-chain matching engine + on-chain Paraclear settlement contract
Standard hybrid architecture: order book and matching run off-chain, final settlement occurs on-chain in the Paraclear contract. The executor role submits matched trade settlements; off-chain signature validation is in the process of migrating to SNIP-12 on-chain validation as of the May 2025 audit.
Oracle / Centralized Price Feed
Single executor submitting EWMA mark prices for all liquidation and settlement calculations
Paradex's Oracle contract accepts price submissions from a single authorized executor. The May 2025 audit found a Critical oracle re-initialization vulnerability (fixed). The team acknowledged oracle centralization risk and described a 'long migration plan' to decentralize price feeds — as of the audit, no timeline was committed.
Risk Management / Insurance Fund
USDC insurance fund (~$4.1M) with socialized loss backstop
Insurance fund absorbs liquidation shortfalls before losses are socialized to profitable traders. No ADL (auto-deleveraging) — uses socialized loss model. Current insurance fund is $4.1M against $39.5M TVL and $32.3M open interest.
Governance / Token-Weighted
DIME native AppChain token (governance + fee utility)
DIME is the Paradex Chain native token. Launched early 2026, $4.7M market cap, 22.2% circulating. ATH $0.0722 (March 2026), current $0.0211 — down 71% from ATH. 77.8% of supply not yet circulating. Multisig governance with no upgrade delays on core contracts.
How the Pieces Interact
If the Privacy Council (3/3 threshold) and centralized sequencer collude or simultaneously fail, the L2 state becomes unrecoverable and all user USDC in the Paraclear contract can be permanently frozen. L2Beat explicitly rates this risk 'Bad' — there is no user-accessible exit mechanism that doesn't depend on the Privacy Council providing decryption keys.
Two multisigs controlling Paradex can upgrade the Paraclear contract (which holds all user USDC) with zero timelock. A compromised or malicious multisig key holder could upgrade the contract to drain funds before users can exit. The 3/6 threshold means 3 of 6 signers are sufficient — a targeted attack on 3 known multisig members.
The centralized executor submits mark prices used for all liquidation decisions across all 85+ markets. A malicious or compromised executor could submit manipulated prices triggering incorrect liquidations or preventing necessary liquidations, creating or hiding bad debt. The May 2025 audit found a Critical oracle re-initialization vulnerability that could have allowed arbitrary price manipulation.
Stwo's Circle STARK proof system using the M31 field is in its first-ever production deployment. If a proof validity bug exists in the new prover, invalid state transitions could be finalized on Ethereum L1, allowing incorrect settlement of trades, manipulation of position values, or fraudulent fund extraction without the attack being detectable by the L1 verifier.
The $4.1M insurance fund covers 10.4% of $39.5M TVL. A synchronized large-position liquidation event (e.g., major market shock causing multi-position insolvency) could exhaust the fund and trigger socialized losses across all profitable traders — a risk mechanism that can cause unexpected loss for uninvolved market participants.
What Could Go Wrong
- Encrypted data availability controlled by a 3/3 Privacy Council: Paradex posts encrypted state diffs to Ethereum as EIP-4844 blobs. All three Privacy Council members must provide decryption keys for data availability to hold. L2Beat rates this 'Bad' — if the Privacy Council fails to disclose keys, user funds can be permanently frozen. Users cannot independently reconstruct L2 state without this council.
- Centralized sequencer with no censorship resistance: a single centralized sequencer processes all transactions. L2Beat rates sequencer censorship resistance as 'Bad' — there is no mechanism to force transaction inclusion if the sequencer is offline or censoring. No escape hatch exists.
- Instant contract upgrades with no timelock: two Paradex multisigs (2/5 and 3/6 thresholds) can upgrade core contracts including Paraclear (which holds all user USDC) with zero delay. Users cannot exit before an upgrade takes effect. Only the SHARP verifier contract has an 8-day upgrade delay.
- Centralized oracle for all mark prices and liquidations: Paradex uses a single centralized executor to submit EWMA-based mark prices used for liquidations. The May 2025 audit found and fixed a Critical oracle re-initialization vulnerability. This centralization was acknowledged as an ongoing risk with a 'long migration plan' to on-chain validation.
Privacy Council Failure and State Freeze
TailTrigger: All three Privacy Council members are simultaneously unavailable (legal action, hardware failure, or coordinated regulatory action), or 2-of-3 members collude with the centralized sequencer to finalize a fraudulent state root on Ethereum.
- 1.Privacy Council members become unavailable (simultaneously, due to legal action against the team, hardware loss, or deliberate collusion) — Encrypted state diffs posted to Ethereum cannot be decrypted; the current L2 state cannot be independently reconstructed by users or third parties
- 2.Users attempt to withdraw USDC by initiating bridge exits, but exits require a valid L2 state proof that the Privacy Council must validate — No valid proof can be produced without decryption keys; all USDC in the Paraclear contract becomes inaccessible
- 3.If the sequencer and 2+ Privacy Council members collude, a fraudulent state root can be finalized on Ethereum encoding the attackers' wallets as having the full Paraclear balance — The L1 bridge contract is drained based on the fraudulent but cryptographically valid STARK proof; Ethereum cannot distinguish between a legitimate and fraudulent state transition
- 4.Users are left with claims against Paradex entities (if any remain accessible) but no on-chain recovery mechanism exists — no escape hatch, no force-exit queue — Total loss of all user USDC ($39.5M current TVL); legal recovery is the only recourse
Risk Profile at a Glance
Overall: C- (51/100)
Lower score = safer