Meteora & Sherlock: Securing Solana’s Liquidity Backbone

Meteora at Solana scale

Meteora builds the liquidity infrastructure behind a substantial share of trading on Solana. In H1 2026, its markets processed $32.1 billion in volume and captured 26.7% of Solana’s spot AMM fees, ranking first among general-purpose AMMs by fees. DLMM powered $1.47 billion in tokenized-equity volume during the same period.

Launchpads and token teams use Meteora to bring new assets to market. Liquidity providers supply capital to its pools and earn trading fees. Traders buy and sell in those markets, including through Solana wallets and trading apps that connect to Meteora’s pools. Together, these groups make Meteora part of a market from its first launch to everyday trading.

As Meteora expands how markets launch and trade, each release has to preserve the rules that govern real capital.

Sherlock’s 2026 reviews followed that responsibility across live swaps, staking rules and DLMM Pro’s new architecture.

The systems behind Meteora’s next phase

Three systems show the direction of Meteora’s 2026 roadmap: sharpen the trading engine people use today, connect incentives to its liquidity community, and prepare more configurable markets for what comes next.

1. Trade with precision. DLMM is Meteora’s flagship liquidity engine. It concentrates capital in chosen price bins, adjusts fees as markets move, and supports native limit orders for traders. Dynamic Terminal gives liquidity providers a way to manage positions.
2. Reward participation. Referral Staking connects $MET utility with Meteora’s liquidity community and referral program, using a portion of DLMM protocol fees to support rewards. Staking, cooldowns and immediate unstaking penalties add rules that must stay predictable as participation grows.
3. Build the next market architecture. DLMM Pro is designed to bring Meteora’s launch and liquidity tools together in a more configurable system, including NFT-based positions. Meteora has unveiled the design and opened a waitlist ahead of broader access.

Together, these systems widen the security surface from live swap execution to staking rules and the design of a new AMM. Each became a separate Sherlock review in 2026.

Security review across the 2026 roadmap

From March through August 2026, Meteora brought Sherlock into three scoped reviews of DLMM, Referral Staking and DLMM Pro. The work moved from an established trading engine to a new incentive program and then to Meteora’s next market architecture.

The three engagements followed distinct systems and risks:

• DLMM update: This review covered swaps, native limit orders, fees, operator permissions and deposits.
• Referral Staking: A review covering staking, withdrawals, cooldowns, immediate unstaking penalties, fee handling and access controls.
• DLMM Pro: A 100+ file scope brought the new AMM architecture under review ahead of broader access.

Each system changed the security question. DLMM had to keep quotes, fills and fees consistent as orders crossed liquidity sources. Referral Staking had to account for deposits, cooldowns and penalties. DLMM Pro required scrutiny of a more configurable market architecture before broader use.

Sherlock’s collaborative audit model brought returning specialists to these 2026 scopes. bin2chen and carrotsmuggler worked on both DLMM reviews; g and 0xeix reviewed Referral Staking. Each audit had a defined scope while researchers carried relevant context about Meteora’s liquidity and fee paths forward.

The partnership carries technical context from one release into the next.

Returning researchers had direct experience with Meteora’s access controls, liquidity accounting and fee paths. That familiarity gave them context for examining how new features interacted with the behavior users already depended on.

Inside the DLMM update

During the March–April 2026 DLMM update, Sherlock examined a scope spanning swaps, native limit orders, fees, operator permissions, and deposits. 

The review produced 17 findings: 6 Medium and 11 Low/Informational, with none rated High. One resolved Medium exposed an execution mismatch when a swap drew from more than one kind of liquidity.

When one swap uses two kinds of liquidity

An exact-output swap lets a trader specify how much they want to receive. DLMM then determines the input required. A single bin can fill that order using both market-maker and limit-order liquidity, with each segment rounding its input calculation separately.

Sherlock found that DLMM estimated input once for the combined output, although execution calculated the input separately for each segment. In a simple example, the estimate was five units while the two segments required six. The trade could revert even when the trader’s maximum input was sufficient.

Meteora’s fix

Meteora changed the calculation to determine the required input for each liquidity segment before combining the amounts. That fix aligned the estimate with how the trade actually executes, strengthening a user-facing swap path as limit orders become part of the same market.

Built for Solana’s next generation of markets

Meteora launched native limit orders in May. By June, 1,231 wallets had placed orders and $18.2 million had traded through the feature. At that level of use, accurate swap and fee calculations are a practical concern for traders and liquidity providers.

Tokenized-equity trading shows how far Meteora’s live DLMM already reaches. Referral Staking ties DLMM usage to $MET utility and community growth. DLMM Pro points to more configurable launch and liquidity markets. Sherlock’s three 2026 reviews followed that progression, from active trading paths to new architecture.

Sherlock identified a DLMM execution mismatch that Meteora corrected, reviewed the rules behind Referral Staking, and examined DLMM Pro ahead of broader access. For Meteora, the value is a security partner with context across its core systems. For Sherlock, the work shows what sustained specialist review can contribute at Solana scale. For the network, it puts focused scrutiny behind the liquidity infrastructure its users depend on.

Secure your next release with Sherlock

Building financial infrastructure that other teams and users depend on? Talk to Sherlock about a security review matched to your architecture and roadmap.