Elevated risk — centralized Privacy Council DA, instant multisig upgrades, and centralized oracle create structural vulnerabilities that L2Beat independently rates 'Bad', combined with 83% TVL decline since January 2026.
Risk Breakdown
Top Risks
Encrypted data availability controlled by a 3/3 Privacy Council: Paradex posts encrypted state diffs to Ethereum as EIP-4844 blobs. All three Privacy Council members must provide decryption keys for data availability to hold. L2Beat rates this 'Bad' — if the Privacy Council fails to disclose keys, user funds can be permanently frozen. Users cannot independently reconstruct L2 state without this council.
Centralized sequencer with no censorship resistance: a single centralized sequencer processes all transactions. L2Beat rates sequencer censorship resistance as 'Bad' — there is no mechanism to force transaction inclusion if the sequencer is offline or censoring. No escape hatch exists.
Instant contract upgrades with no timelock: two Paradex multisigs (2/5 and 3/6 thresholds) can upgrade core contracts including Paraclear (which holds all user USDC) with zero delay. Users cannot exit before an upgrade takes effect. Only the SHARP verifier contract has an 8-day upgrade delay.
Centralized oracle for all mark prices and liquidations: Paradex uses a single centralized executor to submit EWMA-based mark prices used for liquidations. The May 2025 audit found and fixed a Critical oracle re-initialization vulnerability. This centralization was acknowledged as an ongoing risk with a 'long migration plan' to on-chain validation.
Frequently Asked Questions
Is Paradex safe to use?
What are the main risks of using Paradex?
What is Paradex's risk score breakdown?
How does Paradex compare to other Derivatives protocols?
Has Paradex ever been hacked or exploited?
Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.