01 · OverviewThe short answer
Meteora is one of the more heavily audited protocols on Solana, and we found no record of its smart contracts ever being exploited. That is a strong starting point. It is not the same thing as “safe”, because most losses in Solana DeFi happen one layer above the protocol: in the tokens people choose, the links they click and the transactions they sign.
It helps to split the question in two. Is the code sound? That is what audits, bug bounties and a clean incident record speak to. Is your use of it sound? That depends on which pool you enter, how you size it, whether the token is honest, and whether your wallet is clean. A perfectly audited pool can still lose you 90% of your deposit if the token in it collapses.
The rest of this page walks through the evidence in order: the audit record, the incidents that did happen, the LIBRA controversy and how the related lawsuit ended, and finally the practical habits that do most of the work of keeping LPs safe. Use the scorecard at the top as you read — tick the habits you already have and see what is left.
02 · CodeAudits and the bug bounty
Meteora lists its audits on an official overview page and hosts the full reports in a public GitHub repository, MeteoraAg/audits. Anyone can read what each firm reviewed, which version, and what was found.
The pattern that matters is not a single audit but repeated audits by several firms across versions. DLMM, the product that carries most of Meteora’s volume, has been reviewed from its early releases through later versions, by different teams with different methods. When a protocol keeps paying for new reviews as it ships new code, that is a meaningful signal.
| Program | Audit firms | What it does |
|---|---|---|
| DLMM | Offside Labs, OtterSec, Sec3, Zenith, Sherlock | Bin-based concentrated liquidity |
| DAMM v2 | OtterSec, Offside Labs, Zenith | Configurable constant-product pools |
| Dynamic Bonding Curve | Offside Labs, OtterSec, Zenith | Launch curves that graduate to DAMM v2 |
| Helper and legacy products | Separate audit pages | Alpha Vault, Presale Vault, Zap, DAMM v1 and others |
Audit pages also exist for DAMM v1, Dynamic Vault, Alpha Vault, Presale Vault, Stake2Earn, Dynamic Fee Sharing, Zap and Referral Staking. If you plan to use one of the smaller helper products, check its specific page rather than assuming the DLMM audits cover it. They do not: each program is separate code.
The bug bounty
Meteora runs a bug bounty through OOO Security, covering DLMM, DAMM v1 and v2, DBC, Alpha Vault and other programs. A bounty gives independent researchers a legal, paid route to report a vulnerability instead of exploiting it. The documentation does not publish the reward amounts, so we do not quote any here; check the program page for current terms.
03 · RecordIncident history: what actually happened
A clean record is not the absence of headlines. It is the absence of user funds lost to the protocol’s own code. Meteora’s record has one notable treasury incident, a historical loss from its Mercurial days, and no exploit of its pool programs that we could find.
About $1.5M lost to a fake counterparty
During a MET buyback, the team sent funds to a fraudulent OTC counterparty posing as a seller, and the tokens were never delivered. Meteora disclosed this in its Q1 2026 holders’ report and said a police report was filed. DeFiLlama classifies it as a social-engineering and impersonation scam. User funds were not affected.
About $800K of MER lost to hackers
Before the rebrand, media reported that roughly $800K worth of the old MER token was lost to hackers. Together with Mercurial’s association with the FTX and Alameda ecosystem, this preceded the decision, announced in December 2022, to relaunch as Meteora.
The OTC loss is worth reading closely, because it is the kind of failure that hits individual users too. Nobody broke a smart contract. Someone impersonated a trusted party and a payment was sent before delivery was secured. The same report put the treasury at about $32.8M with more than two years of runway, so the loss was material but not existential, according to the team’s own figures.
Allegations versus findings
You will also find allegations online. The most prominent came from DefiTuna’s co-founder, who alleged that launches linked to Kelsier, Meteora and M3M3 extracted around $200M from traders. Meteora and Jupiter denied wrongdoing. That claim has not been established by a court or regulator, and we report it only as an allegation so you can recognise it when you see it.
04 · ControversyLIBRA, the resignation and the lawsuit
The LIBRA episode is the main reason people search “is Meteora safe”. The facts, as reported by The Block, Decrypt, crypto.news and court records summarised by the press, are as follows.
The launch
In February 2025, Hayden Davis of Kelsier Ventures launched LIBRA, a token promoted by Argentina’s president, using Meteora pools. The launch and the trading around it drew heavy criticism across the industry.
The resignation
Meteora co-founder and CEO Ben Chow resigned days later. Jupiter co-founder Meow cited a lack of judgement. Chow denied having inside information, while acknowledging he had referred Davis and Kelsier to other projects, including MELANIA.
New leadership
About three weeks later, co-founder Zhen Hoe Yong (“Zen”), who had been interim lead and held a genesis role at both Jupiter and Meteora, was named project lead.
The class action
In April 2025, Burwick Law filed a class action in the Southern District of New York. Defendants included Kelsier Labs, members of the Davis family, “Meteora” and Benjamin Chow.
The ruling
Judge Jennifer L. Rochon dismissed the case with prejudice, denied leave to amend and closed it. The court found that “Meteora” had not been shown to be a suable unincorporated association, that fraudulent intent was not adequately pleaded against Chow, and that the RICO claims lacked a pattern or continuity.
For an LP the practical lesson is narrower than the headlines. No report we found attributes the LIBRA losses to a flaw in Meteora’s code; the controversy centred on the token, its launch and the people around it. Permissionless infrastructure lets anyone launch anything. Meteora’s launch tooling now includes fee schedulers and anti-sniper settings for launch pools, but none of that turns a bad token into a good one.
05 · FrameworkProtocol-level versus user-level risk
Think of risk in two layers. The protocol layer is mostly outside your control; you manage it by choosing audited products and sizing sensibly. The user layer is almost entirely in your hands, and it is where most real losses happen.
| Risk | Layer | You can reduce it |
|---|---|---|
| Smart-contract bug | Protocol | Partial — size and diversify |
| Upgrade or admin-key misuse | Protocol | No — trust assumption |
| Impermanent loss, out-of-range drift | Market | Yes — pair and range choice |
| Rug pull or honeypot token | Token | Yes — verify before depositing |
| Phishing site or fake airdrop | User | Yes — bookmarks, no DMs |
| Leaked seed phrase | User | Yes — offline storage |
Market risk is real risk
In a concentrated DLMM range, a strong price move can push your position fully into the weaker token, where it stops earning fees until price returns or you rebalance. That is not a hack, but it can cost more than one. If a SOL–memecoin position of $2,000 sits in range while the memecoin falls 80%, you end up holding mostly memecoin and the position may be worth well under $1,000. Our impermanent loss calculator shows the math for full-range pools.
Token and launch risk
Pools for new tokens carry their own hazards: a mint that still has a freeze authority, Token-2022 transfer fees that tax every move, or a launch pool whose fee scheduler starts very high and decays. None of these is a Meteora bug; all of them can drain an LP or a buyer.
Small costs that surprise people
Some costs are not risks in the classic sense but feel like losses. Opening a DLMM position requires refundable rent of about 0.059 SOL, but if you are the first LP to touch a new price range you may pay about 0.075 SOL per binArray, and that part is not refundable. Failed transactions still pay network fees, and priority fees can spike in busy markets. Meteora suggests keeping at least 0.05 SOL in your wallet for this reason.
06 · PlaybookSafety habits that actually work
The habits below match the scorecard at the top of the page and Meteora’s own “Staying Safe” guide. Together they remove most of the user-level risk described above.
Reach the app the same way every time
Type meteora.ag once, bookmark it, and use only that bookmark. Around the MET airdrop, lookalike claim domains appeared in search results. Treat any link from a DM, reply or sponsored result as hostile.
Verify the mint, not the ticker
Tickers are free to copy. Compare the token’s mint address with the project’s official channels before swapping or adding liquidity. For MET, the official docs publish the mint address.
Run a token check
Look the token up on RugCheck, JupShield and Jupiter’s Organic Score, and read any risk warning Meteora shows on the pool. Look for active freeze authority, unusual transfer fees and concentrated holdings.
Read before you sign
Your wallet’s transaction preview is your last line of defense. If a “claim” asks for approvals over tokens unrelated to the claim, stop. Wallets such as Phantom include malicious-transaction detection; take its warnings seriously.
Separate hot and cold funds
Keep a small hot wallet for daily DeFi and move the bulk to a hardware wallet or a separate vault address. If the hot wallet is compromised, the damage is capped.
Size for the worst case
Assume any single position could go to zero. A common personal rule is to cap any one memecoin or launch pool at a small slice of your DeFi capital, and keep blue-chip pairs for the larger share.
If you use a browser wallet, our guide to setting up Phantom securely covers hardware-wallet pairing and transaction warnings in more detail.
07 · VerdictHow to judge Meteora for yourself
We do not think “safe” or “unsafe” is a useful label for any DeFi protocol. A better question is whether the evidence matches the amount you plan to put in.
Reassuring signals
- Multiple independent audits per core program, repeated across versions
- Public audit reports and an active bug bounty
- No known exploit of the pool programs
- Openly disclosed treasury incident, with user funds unaffected
- Among the liquidity sources Jupiter routes through
Reasons for caution
- Upgradeable programs mean trusting the team’s key security
- Permissionless pools list tokens of any quality
- Leadership change and reputational damage after LIBRA
- A treasury lost funds to social engineering
- Concentrated liquidity amplifies market losses
A sensible approach is to start small, with a blue-chip pair such as SOL–USDC, and learn how positions, fees and rebalancing behave before you scale up. Read the audit report for the product you use. Keep checking Meteora’s official channels for disclosures, and treat a sudden promise of outsized yield as a question, not an answer.
Nothing on this page is financial or legal advice. It is a summary of public records and Meteora’s own documentation, written so you can make your own call with the facts in front of you.
