Softstack has completed an independent security audit of Lambdaplex's core contracts on Hedera, covering four pillars of the protocol and closing with no open findings.
Client: Lambdaplex
Project: Hedera-native non-custodial spot trading protocol
Industry: Web3 / decentralized trading
Service: Smart contract security audit (manual code review and automated security testing)
About Lambdaplex
Lambdaplex is a Hedera-native trading protocol built for non-custodial spot trading. Instead of routing every trade through a central contract, it places order logic at the account level using Hiero Hooks and the Hedera Token Service. Users install a lightweight on-chain hook that enforces their own price limits, slippage bounds, and oracle-based triggers for limit, market, stop-loss, and take-profit orders. Custody stays with the user. Any broker, solver, or matching engine can execute open orders, while the hook independently validates each transfer.
The settlement layer finalizes those trades on chain, with signed-order authorization, replay protection, and Hedera Token Service transfers. Alongside it sit two vault products: a balanced vault that targets a 50/50 inventory policy with oracle pricing, and a pro rata vault that treats each share as a proportional claim on the vault's live two-asset inventory without relying on an external price feed.
Scope of the Audit
The review covered four pillars of the protocol:
- Balanced vault: share accounting and the 50/50 inventory policy, including oracle pricing and manager-rebalancing bounds.
- Order hook: account-level order logic, price limits, slippage bounds, and oracle-based triggers.
- Settlement layer: signed-order authorization, replay protection, and Hedera Token Service transfers.
- Pro rata vault: proportional share claims against live two-asset inventory without an external price feed.
Methodology
Softstack's audit team conducted a manual code review and automated security testing across the full scope. The work focused on share-accounting correctness, oracle price validation and staleness checks, signed-order authorization and replay protection, manager-rebalancing bounds, access control, and reentrancy protection.
The engagement ran from an initial review in January 2026 through scope expansions for settlement and the pro rata vault, with a final re-check closing the report in August 2026.
Key Findings
The audit identified 34 issues in total:
- 0 critical
- 2 high
- 11 medium
- 13 low
- 8 informational
Of those, 22 were fixed and 12 were formally acknowledged. No findings remained open at the close of the engagement. Both high-severity issues were resolved before final sign-off, and a follow-up review confirmed that the fixes were implemented as intended.
Full audit report: [add report link]
Why This Matters
Security work of this kind only lands when the engineering team treats findings as product decisions, not as paperwork. The Lambdaplex team did that across multiple review rounds and two later scope expansions.
For a protocol that keeps custody with the user and lets any broker or solver execute open orders, the correctness of the hook and settlement logic is what protects traders. Independent review of that logic, repeated as the scope grew, is how a non-custodial design earns the trust it asks for.
About Softstack
Softstack is a German cybersecurity firm based in Flensburg. The company provides smart contract audits, penetration testing, and security consulting for blockchain protocols. Softstack is ISO 27001 certified and has audited protocols safeguarding over $100 billion in user funds.
If you are building trading infrastructure, vaults, or settlement systems and want the same level of scrutiny, reach out at hello@softstack.io or visit softstack.io.
