Is a Perp DEX Safe? Custody, Exits and Liquidations

“Non-custodial” is a label, not an answer. It says a smart contract holds your deposit instead of a company. It does not say how you get out when the servers stop, whether a fill can be undone, or who pays when someone else’s account goes negative. Those answers decide whether your money comes back on a bad day, and they are in every venue’s docs.

Quick answer

Read the docs for six things before you deposit: custody, the exit if the exchange stops, reversed fills, liquidation, losses beyond collateral, and audits. The contract and the exit path matter more than the word on the homepage.

Who holds your funds?

The docs should name the contract and the chain. If the venue moves to a new chain, check again.

Extended: “All user funds are fully self-custodied in on-chain smart contracts, with no custodial access by Extended.” Its docs link the contract on a block explorer.
Katana Perps: assets sit in a contract on the Katana chain, and “Funds can only be withdrawn to the wallet that deposited them.”
Lighter: contracts on Ethereum hold deposits and the canonical Lighter state root.
Arcus: a Bridge Vault on an EVM rootchain holds funds and withdrawable balances.

Can you get out if the exchange goes offline?

This is the escape hatch: a way to withdraw straight from the contract when the operator’s servers stop.

Lighter: exit requests go to a priority queue on Ethereum. If the sequencer does not process them in time, Escape Hatch mode freezes the contract and users withdraw by proving balances from data posted on Ethereum.
Katana Perps: a wallet exit function called directly on the contract, which bypasses the exchange’s off-chain systems entirely.
Arcus: an emergency settlement in the rootchain contracts. The docs add that it “depends on data availability, which the appchain validators ensure.”

Read the dependency line, not only the feature name. An exit that needs another party online is weaker than one that works from the chain alone.

Can a fill be reversed?

Many perp DEXs match orders off-chain for speed and settle on-chain. The docs should say what happens when the two disagree.

Paradex: the matching engine runs in the cloud and the chain validates each trade. A trade that fails on-chain validation is busted and the account reverted. Paradex says rejections are uncommon.
Arcus: executed trades are final, except that if the escape hatch activates, trades since the last committed state root are busted.

How does liquidation work?

Liquidation is the most common way traders lose a deposit. Read the exact rule.

Hyperliquid: below maintenance margin, the venue first closes positions through the book, and the trader can keep the remaining collateral. Below 2/3 of maintenance margin, if that fails, a backstop vault can take over, and the maintenance margin is not returned.
Lighter: a waterfall of pre-liquidation, partial and full liquidation, with “up to 1% liquidation fee” in the partial step, sent to its insurance fund.
Katana Perps: below maintenance margin, all open positions are closed and the wallet’s balance and equity are zero. Its FAQ describes cross margin, where every position shares one pool.

Check the margin mode, the trigger, partial or full close, and the fee. Funding also moves your liquidation price over time; see the funding rate guide.

Who pays when losses exceed collateral?

Usually an insurance fund first, then auto-deleveraging (ADL): closing profitable positions on the other side.

Hyperliquid: ADL ranks opposite positions by unrealized PnL and leverage. A user with no open positions does not share platform losses.
Lighter: its insurance fund takes over positions while it stays above its margin requirement; the rest are deleveraged by leverage and unrealized PnL.
Extended: accounts are protected from ADL while their Total Value stays above zero.

What was audited?

An audit covers the code it names, on the date it names. A bridge audit says nothing about the matching engine, and a report on a shared codebase may not name the venue you use. Read the scope: the custody contract, the matching or proving system, or only a bridge. Then check the date. Each project page links the venue’s own sources.

The checklist before your first deposit

Which contract holds my funds, on which chain?
Is there an escape hatch, and what does it depend on?
Who matches orders, and when can a filled trade be reversed?
Cross or isolated margin? What triggers liquidation, and what is the fee?
Is there an insurance fund, and how does ADL pick positions?
Which code was audited, by whom, and when?
How long has it been live, and what incidents does the venue report?
Which regions do its terms exclude?

What this means for a farmer

Leave only the margin the farm needs. Venue risk scales with the balance you keep there.
A hedge carries two venues’ risk. Long on one venue and short on another, a failure on either leaves the other leg open. ADL can close your winning leg early and leave the losing one running.
Leverage brings liquidation closer. Volume farms often build size with leverage. On a venue that closes everything at once, one bad candle can end the account.

Good answers lower risk, they do not remove it. Audits miss bugs, an escape hatch is only tested when it is needed, and prices can outrun any liquidation engine. Only risk what you can afford to lose.

Trust is one of six criteria in our rating method, covering custody, audits, time live and incidents. Each project page lists the facts behind it and its risks.

Frequently asked

Is a non-custodial perp DEX safer than a centralized exchange? It removes one risk, a company holding your money, and adds another, smart contract risk. Compare the exit path and audits, not the label.

Does an audit mean a DEX is safe? No. It means named code was reviewed on a named date. Check the scope.

Why did I lose my whole margin in a liquidation? Some venues close every position and leave a zero balance, as Katana Perps does. On Hyperliquid, a backstop liquidation does not return the maintenance margin.