Derive (formerly Lyra) Review
Options and perp fees published in full, with a named V3 audit
of 10
Derive scores 5.2 in DeFi protocols. It publishes every trading fee and names a published ZKSecurity audit of its new V3 contracts on Ethereum. No public source or licence exists for the V3 core, and a 6-of-8 multisig can bypass the timelock. Desk research checked November 1, 2026.
Overall score
5.2 = (9 + 0 + 7 + 5 + 5) / 5
Version rated
V3: zk proofs verified on Ethereum L1, data on Celestia (DIP, 14 Sep 2026)
Perp taker fee
$0.01 + 0.03% of notional; maker 0.01%
Options taker fee
$0.50 + lower of 0.03% of notional or 12.5% of premium
V3 audit
ZKSecurity, core contracts and protocol (report PDF on derive.xyz)
Contract control
Derive Subsidiary (BVI) Ltd multisig; timelock with 6-of-8 bypass
Scores
Each criterion carries equal weight. The overall score is the average of these 5 scores — (9.0 + 0.0 + 7.0 + 5.0 + 5.0) ÷ 5 = 5.2.
Pros
- Fees 9: every order-book fee published, including perp taker $0.01 + 0.03% of notional
- Options taker fee capped at 12.5% of premium, so cheap options are not overcharged
- Audit 7: ZKSecurity named for V3 core contracts, with the report linked as a PDF
- Ethereum contract addresses published, with an escape hatch if the operator goes offline
Cons
- Licence 0: no public repository or licence file for the V3 core contracts
- Governance 5: BVI subsidiary multisig owns contracts; 6-of-8 path can bypass the timelock
- Timelock length and Security Module size and funding are not stated
- Only one firm is named for the V3 core audit
How Derive scores in DeFi protocols
This entry rates Derive, the options, perpetuals and spot exchange formerly called Lyra, in our DeFi protocols ranking. It rates the current V3 deployment. A Derive Improvement Proposal (DIP) posted on 14 September 2026 moved trading from Derive's own rollup, Derive Chain, to contracts on Ethereum mainnet. Batches are proven off-chain with the SP1 zkVM, verified on Ethereum, and their state changes are posted to Celestia for data availability. The basis is desk research of Derive's documentation, terms, governance forum, GitHub organization and Etherscan, checked on November 1, 2026. No account was funded and no trade was placed. The category has five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.
| Criterion | What the sources show | Mark |
|---|---|---|
| What it does & fees | Every order-book fee is published: spot is free; perps are $0.01 + 0.03% of notional (taker) and 0.01% (maker); options are $0.50 + the lower of 0.03% of notional or 12.5% of premium. RFQ discounts and the 10% liquidation fee are stated. | 9 |
| Licence & code openness | No public repository or licence file for the V3 core contracts or proving program. The SDKs are MIT. The BUSL-1.1 v2-core repository covers the retired V2. | 0 |
| Audit disclosure | The homepage names ZKSecurity as auditor of the V3 core contracts and protocol and links a V3 audit PDF. Sigma Prime's public repository holds earlier Derive reports. | 7 |
| Backing & transparency | Deposits sit in published Ethereum contracts, with an escape hatch. Collateral is listed per risk universe. The Security Module's size and funding are not stated. | 5 |
| Governance & control | The DIP says a multisig of Derive Subsidiary (BVI) Ltd owns the contracts. It acts behind a timelock of unstated length, and a 6-of-8 path can bypass it. | 5 |
The overall score is the plain average: (9 + 0 + 7 + 5 + 5) / 5 = 26 / 5 = 5.2, the same as at the July 24, 2026 check, although four marks changed with the V3 move. Licence & code openness fell from 5 to 0: the BUSL repository it was based on no longer covers the live protocol, and under the licence scale applied across the category on November 6, 2026, live contracts with no public source score 0. Audit disclosure rose from 5 to 7, because a V3 core audit is now named and published. Backing & transparency rose from 3 to 5 and Governance & control from 4 to 5, because the V3 documentation and DIP now state where funds sit and who controls upgrades. The fee mark stays at 9. The earlier review gave the perpetual taker base fee as $0.1; the trading-fees page states $0.01.
Strongest criteria
Fees stated in full (9)
The trading-fees page gives every component for every instrument, so a trader can work out a fee before placing an order. The 12.5%-of-premium cap matters for cheap out-of-the-money options. Without it, a notional-based fee could cost more than the option. RFQ (request for quote) rules are also given exactly. The cheapest leg group of a multi-leg package trades free, the next two get 50% off, so the second leg of a two-leg spread pays nothing. The mark stops short of 10 because volume and staking discounts appear as tiers in the app rather than as a published table.
A named, published V3 audit (7)
Derive's homepage says "ZKSecurity audited V3's core contracts and protocol" and links the report as a PDF. It also links Sigma Prime's public-audits folder for Derive, which holds reports on earlier components, including v2-matching. That is a real improvement on July, when the only audit we could find covered vault strategies. It stays below the strongest entries in this category because one firm covers the V3 core. The homepage's statement that all critical findings were addressed is the company's own claim.
Weakest criteria
Licence: a deficiency, not a gap in our reading (0)
Derive's GitHub organization has MIT-licensed SDKs (derive-py, derive-ts, derive-rs) and bridge plugins. It has no repository for the V3 contracts or for the zkVM program that enforces margining and settlement. The main V3 contract on Etherscan is a verified upgradeable proxy with no licence identifier. The DIP says the exchange binary will be published shortly after launch, but as of November 1 we found no repository or licence. The category gives 0 when no public source exists for the live contracts, as for Synthetix; 2 is reserved for code that is visible under a licence that is not open source, such as Term Finance's. The mark will be revisited once the V3 source is published.
Backing and control: disclosed, but with open questions (5 and 5)
V3 publishes its Ethereum contract addresses. Withdrawals pay out once their batch is verified. If the operator goes offline, users can claim funds directly from the withdrawal outbox contract. Collateral lists are published for each of the four risk universes, and losses are shared only within the universe where they arise. What is missing is the size of each Security Module and how it is funded, so the backstop cannot be measured. On control, the DIP says a multisig owned by Derive Subsidiary (BVI) Ltd, a subsidiary of the Derive Foundation, owns the contracts. The timelock length is not given, a 6-of-8 path can bypass it, and the move to stDRV on-chain governance is left to a later proposal. The arrangement is now disclosed, which is why the mark rose, but it is still a company-controlled multisig.
What the score does not cover
The score covers published disclosure. It does not measure liquidity, spreads, execution quality, uptime or the soundness of the zkVM proofs and Celestia data availability that V3 relies on. It also does not cover returns from Derive's vaults or the DRV token. Access is a separate matter. The Terms of Use, operated by Lyra Technologies Corp and updated on September 23, 2026, exclude US persons, Australian tax residents and Ontario residents, and limit UK users to professional and high-net-worth investors. Options and leveraged perpetuals can lose more than the margin posted. Our risk management guide covers position sizing.
Derive vs Synthetix and Ondo Finance
Synthetix, the other derivatives venue in this ranking, scores 3.4. It shares Derive's licence mark of 0 for unpublished core code and trails on fees (8 against 9), audits (3 against 7), backing (3 against 5) and governance (3 against 5). Ondo Finance, at 6.8, leads Derive on licence (5 against 0, for BUSL-1.1 code), audits (10 against 7) and backing (8 against 5). Derive leads Ondo on fees (9 against 8) and governance (5 against 3). Term Finance also scores 5.2; Derive is listed first only because ties are ordered alphabetically. Term leads on licence (2 against 0) and backing (6 against 5), and Derive on fees (9 against 8), audits (7 against 6) and governance (5 against 4).
Who it suits
On these marks, Derive suits traders outside the excluded jurisdictions who want an options venue where fees can be calculated in advance and funds can be withdrawn from Ethereum through an escape hatch. It suits less well anyone who needs to read the code that enforces margin and settlement, or who wants a timelock that cannot be bypassed. Those are the two areas most likely to move the score at the next check.
How it compares
Nexus Mutual
GPL code, an on-chain capital pool and a per-release audit log
Reserve
Open-source basket tokens with capped fees and 19 audits
dHEDGE
Open AGPL code and a full, linked audit archive
Maple Finance
Dated, linked audits for every release since V2
Index Coop
Per-product fees, Apache code and six named auditors
Ondo Finance
Thirteen named auditors and daily attestations on tokenized assets
Term Finance
Fixed-rate loans with published fees and a worked example
Synthetix
A published, volume-tiered perps fee schedule
Sources
Scored from published primary sources rather than hands-on use. Every figure above comes from one of the pages below, on the date shown. Manufacturers change prices and specifications without notice — if something here no longer matches the source, tell us and we will correct it.
- 1.Derive — homepage (ZKSecurity V3 audit, audit links) — checked
- 2.Derive — V3 audit report (PDF) — checked
- 3.Derive forum — DIP: Launch Derive V3 (14 Sep 2026) — checked
- 4.Derive docs — Trading fees — checked
- 5.Derive docs — Introduction (V3 architecture) — checked
- 6.Derive docs — Contracts (Ethereum mainnet, escape hatch) — checked
- 7.Derive docs — Risk universes — checked
- 8.Derive — Terms of Use (updated 23 Sep 2026) — checked
- 9.Derive — GitHub organization (repositories and licences) — checked
- 10.Sigma Prime — public audits, Derive folder — checked
- 11.Etherscan — Derive V3 VAPP contract — checked
Frequently asked questions
Why does Derive score 5.2?
It is the plain average of five equal marks: fees 9, licence 0, audits 7, backing 5 and governance 5. Full fee disclosure and a named V3 audit lift it. The lack of public V3 source code pulls it down.
What changed since the July 2026 score?
Derive moved to V3 on Ethereum mainnet. Licence fell from 5 to 0, because the BUSL v2-core repository no longer covers the live code and no public source exists for the V3 core; 0 is the mark the category's licence scale, applied on November 6, 2026, gives in that case. Audits rose from 5 to 7, backing from 3 to 5 and governance from 4 to 5, all on new V3 disclosures. The overall score is 5.2, the same as in July, because the licence drop offsets those gains.
What would raise Derive's score?
Publishing the V3 contracts and proving program under a stated licence would most likely raise the licence mark. Stating the timelock length, removing or limiting the bypass, and publishing each Security Module's size would raise the governance and backing marks.
Was Derive tested hands-on?
No. The score is based on desk research of Derive's documentation, terms, governance forum, GitHub and Etherscan, checked November 1, 2026. Liquidity and execution quality were not measured.
How does Derive compare with Synthetix?
Derive scores 5.2 and Synthetix 3.4. Both have a licence mark of 0, because neither has published the source of its live core. Derive leads on fees, audits, backing and governance.
Nothing here is financial advice. Editorial policy · How we score · How we're funded.