Raydium AMM Security Review: Concentrated Liquidity, Admin Keys, and Protocol Risk

The Short Version

Raydium is the largest AMM on Solana by liquidity, holding about $813M in TVL as of July 29, 2026. It is where most on-chain SOL trades route, and it is the venue a huge share of new Solana tokens launch their first pool on. If you provide liquidity anywhere on Solana, there is a good chance some of it sits in Raydium.

Depth is not the same as safety. Raydium is one of the few large Solana protocols with an actual exploit on its record, a December 2022 hack that drained several pools through a compromised admin key. The code that got hit has since been retired and the authority moved, but the episode is exactly the kind of thing a security score has to weigh honestly.

yieldwire scores Raydium at 63, Grade C, with HIGH confidence. That is a middle-of-the-pack score for a top-tier protocol, and the gap between its size and its grade is the whole story. The audit picture is thinner and less consolidated than the Solana lending leaders, there is a real hack in the history, and liquidity provision on an AMM carries impermanent loss that no audit can remove. Here is the full breakdown.

What You Are Actually Providing Liquidity Into

Raydium is not one contract. It runs three separate AMM engines, and your risk depends on which one your position sits in.

The legacy AMM, the original constant-product pools, is the oldest code and the part that was exploited in 2022. Raydium has been migrating liquidity off it for years, and new activity is steered elsewhere, but some deprecated pools still exist and remain a place to be careful. The CPMM, the standard AMM that replaced the legacy engine, is a cleaner constant-product design built for the current era and is where most simple pair pools now live. The CLMM, the concentrated liquidity engine, lets providers place capital inside a chosen price range for higher fee efficiency, the same model Orca Whirlpools and Uniswap v3 use.

This split matters for a security read because the three engines have different code, different audit coverage, and different risk. A CLMM position is not the same product as a legacy pool position, even though both live under the Raydium brand.

The Audit History

This is where Raydium loses ground against the Solana lending leaders, and the reason is subtle. Raydium is audited. It is not audited in the deep, consolidated, publicly indexed way that lifts a protocol into A territory.

Over the protocol's life, reviews have come from Kudelski Security, which audited the code before the 2022 hack, OtterSec, which reviewed the CLMM program, and MadShield, now operating as OShield, which contributed later reviews. Raydium also runs a live bug bounty through Immunefi. The audit PDFs live in the protocol's public docs repository, so the trail is verifiable rather than a marketing claim.

The honest caveat is twofold. First, Kudelski's review predates the exploit, and the exploit did not come from a code bug it would have caught, it came from a compromised private key, which is a different failure class entirely. Second, DeFiLlama lists no consolidated audit count for Raydium, which is why yieldwire's table marks it with an asterisk rather than a clean number. The reviews exist and yieldwire counts them in the HIGH confidence rating, but the coverage is spread across engines and firms rather than concentrated into the kind of formal-verification-plus-multiple-firms stack that Kamino publishes. For an AMM this large and this heavily forked into new token launches, a thinner audit picture is a real mark against the safety sub-score, which lands at 65.

The December 2022 Hack

Any security review of Raydium has to deal with the exploit directly, because pretending it did not happen would be dishonest and because what it taught is still relevant.

On December 16, 2022, an attacker gained control of the owner authority over Raydium's legacy constant-product pools. The compromise did not come through a smart contract vulnerability. It came through a trojan that stole the private key controlling the pool authority account, which handed the attacker admin-level access. With that access the attacker drained roughly $4.4M across eight legacy liquidity pools. Critically, the concentrated liquidity pools and the RAY staking programs were untouched, because they sat under different authority.

The response is the part worth studying. Raydium revoked the compromised account's authority, patched the affected programs, and moved control to a hardware-wallet-backed setup rather than a hot key. In other words, the fix addressed the actual root cause, which was key management, not a logic flaw.

The lesson generalizes. The most dangerous surface on an AMM is often not the swap math, it is who holds the keys that can touch pool authority and how those keys are stored. A hot key controlling live pools is a single point of catastrophic failure, and Raydium learned that the expensive way. The reason this still weighs on the score is that a hack in the record, even one that was patched and repaid, is evidence of past operational risk, and operational risk is harder to fully audit away than code risk.

Impermanent Loss in Concentrated Positions

Even with perfect code and perfect key management, providing liquidity on an AMM carries a risk no audit removes: impermanent loss. It is not a bug, it is the mechanism.

When you provide to a pool, the AMM rebalances your two assets as the price moves, selling the winner and buying the loser to keep the pool balanced. If the price diverges from where you entered, the value of your position ends up lower than if you had simply held the two tokens, and the fees you earn have to make up that gap for the position to come out ahead.

On the CLMM, this effect is amplified. By concentrating your liquidity into a tight price range you earn far more fees while the price stays inside that range, but you also take on far more impermanent loss when it moves outside it, and once the price leaves your range you stop earning fees entirely until it returns or you rebalance. Concentrated liquidity is an active strategy that behaves more like running an options position than parking capital. It is not a set-and-forget yield. For a volatile Solana token pair, a poorly ranged CLMM position can lose to a simple hold even with healthy fee income.

This is why the yieldwire read on Raydium separates the protocol risk from the strategy risk. The contracts can be sound and your position can still lose money because you mispriced the range. Model it before you commit, and treat a new-token CLMM pair as the high-variance instrument it actually is.

Fee Mechanics

Fees are the return that has to outrun impermanent loss, so the mechanics matter. Raydium's standard pools charge a trading fee on each swap, and the CLMM offers multiple fee tiers, roughly from 0.01% for stable pairs up to 1% for exotic ones, so pool creators can match the fee to the pair's volatility. Higher-volatility pairs justify a higher fee because providers there carry more impermanent loss.

A portion of protocol fees routes to RAY buybacks, which is a value-accrual mechanism for the token rather than something that changes a liquidity provider's direct risk. What matters for a provider is the net: fee income minus impermanent loss minus gas. In a deep, low-volatility pool the fees are thin but so is the impermanent loss. In a shallow, high-volatility launch pool the fees look enormous and so does the risk of the pair moving against you. The headline APY on a hot new pool is almost always quoting the fee income without netting the impermanent loss, and that is the single most common way liquidity providers on any AMM talk themselves into a losing position.

Admin Keys and Governance

The 2022 hack was a governance-surface event, so this section carries extra weight for Raydium specifically.

Since the exploit, pool and program authority moved off a single hot key to a hardware-backed, more controlled setup, which is the correct direction. The protocol is governed alongside the RAY token, and program upgrades and parameter control remain powers that a trusted set of keyholders can exercise. As with every protocol in this class, upgrade authority is the thing to understand: someone can change the code or the parameters your position lives under, and the question is who and how fast.

The decentralization sub-score lands at 60, below the Solana leaders. The reason is a combination of past key-management failure and an admin surface that, while hardened since 2022, still concentrates meaningful control. This is not a reason to avoid Raydium. It is a reason to know that the venue's history is one of operational compromise rather than pure code exploit, and to size accordingly.

The yieldwire Security Score

Putting it together, here is how the score is built.

The composite of 63 puts Raydium in the C band, below Orca DEX at 75 in the same category. The HIGH confidence tag is important here in an unusual way: it means the score rests on a well-documented record, including the well-documented hack, not on an automated estimate. yieldwire is confident in the 63 precisely because there is a lot of verifiable history to score.

The score is a protocol-safety read, and it deliberately does not price the impermanent loss of any specific position, because that depends entirely on the pair and the range you choose. A CLMM position on a stable pair and a CLMM position on a day-old memecoin carry wildly different risk under the same score.

Bottom Line

Raydium is the backbone of on-chain liquidity on Solana. It is deep, it is where trades route, and it is where new tokens go to live. The Grade C is not a claim that it is unsafe, it is a claim that a top-tier venue with a real hack in its record, an audit picture spread thinner than the lending leaders, and the built-in impermanent loss of AMM provision does not clear the bar for a B.

The practical read is to separate the two risks. The protocol risk is moderate and well-documented, hardened since 2022 but marked by that history. The strategy risk, impermanent loss on concentrated positions, is entirely in your hands and is where most providers actually lose money. Use the deep pools for what they are good at, treat new-token CLMM pairs as high-variance, and model the range before you commit.

See the full breakdown on the Raydium protocol page, compare live pool yields on the yields page, read how every grade is built on our security methodology, and model impermanent loss on any position with the calculator.

---

TVL (about $813M, Solana) pulled from DeFiLlama on-chain data as of July 29, 2026, and floats continuously. Audit history sourced from Raydium's public documentation repository and the auditing firms' published reports. The December 2022 incident is sourced from Raydium's own postmortem and independent security analyses. Security scores derived from yieldwire's scoring methodology. Governance and authority details reflect published documentation and may change through governance; verify live on-chain configuration before sizing a position. Impermanent loss depends on the specific pair and range you choose and is not captured by the protocol score. This is not financial advice.