Crypto · DEX comparison

Which DEX is really decentralized? Hyperliquid, Aster, ApeX Omni, dYdX, PancakeSwap and Uniswap compared on custody, exits and control

By VoxTradePro Desk · Published 2 Nov 2026, 15:00 UTC+8 · Updated 2 Nov 2026, 16:20 UTC+8 · 11 min read

A side-by-side, source-based comparison of six DEXs: who holds funds, who approves withdrawals, forced exits, open code, website blocks and regions.

Educational comparison only, not financial advice. Everything below comes from each platform's own docs, terms and code, from L2BEAT, or from named reports, checked on 2 November 2026. Designs and rules change, so check the live pages before you deposit.

"Decentralized exchange" is a label, not a guarantee. This final part of our series compares six platforms on the same questions. It builds on our Aster review, our Hyperliquid review and the case study of a wallet flagged as high risk by unwanted dust. The goal is not to rank good and bad projects. It is to show where each one sits between "your own wallet" and "a company account", so you can choose with open eyes. Several of these platforms are, in practice, not fully decentralized, and most say so in their own documents.

The questions we asked

1. Who holds the funds while you trade? Your own wallet, a smart contract, or a balance on the platform's own chain?
2. Who approves withdrawals, and how many independent parties is that?
3. Is there a forced exit? Can a user get funds out through a contract even if the operator stops or refuses?
4. Can the contracts or chain be upgraded, and with how much warning?
5. Is the code open source?
6. Can the official website block you? And are there other ways in?
7. What do the terms allow the operator to do?
8. Which regions are restricted?
9. Has the operator or validator set intervened before?

Uniswap (spot swaps)

Uniswap is the clearest example of the self-custody end. Its protocol docs say the core contracts are "not upgradeable" once deployed and that "no party can pause them, reverse trade execution, or change protocol behavior retroactively". A swap settles straight from your wallet, so there is nothing to withdraw.

The website is a separate matter. Uniswap Labs, a US company, runs app.uniswap.org and says in its address screening guide that it blocks wallets linked to sanctions, hacked funds and other illegal activity using third-party analytics. Its terms bar sanctioned persons and residents of comprehensively sanctioned territories; they do not list the US as restricted. Because the contracts are public, other interfaces can reach the same protocol.

Trade-offs: gas costs, price slippage on large orders, no built-in leverage, and nobody to call if you sign a bad transaction.

PancakeSwap (spot vs Perpetual)

PancakeSwap's terms describe the website as "purely non-custodial": it never holds your assets and cannot move what is in your wallet. Spot swaps work like Uniswap's.

The Perpetual section is different. PancakeSwap's docs say it is "powered by Aster's orderbook infrastructure", and its perps FAQ lists restricted jurisdictions including the United States, Canada, the United Kingdom, China and South Korea. So the same brand covers two very different trust models.

dYdX Chain (v4), and what dYdX v3 proved

dYdX now runs its own blockchain. Its architecture page says the chain is built on CometBFT and the Cosmos SDK, that the protocol, the Indexer and the front ends are all "available as open source software", and that "none of the components are run by dYdX Trading Inc." The chain code is public on GitHub under dYdX's own licence. One design detail: validators keep the order book "in-memory" (off-chain, not committed to consensus), and only matched trades go on-chain.

The official website is run by dYdX Operations Services Ltd. Its help page says wallets that access it from restricted regions "may be flagged" and put into close-only mode, in which users can cancel orders, reduce or close positions and "withdraw funds from the chain", but cannot deposit or open new positions. That is a notable design choice: a restriction that still lets users leave. The dYdX Software Terms bar people in the US, Canada and the UK from the perpetuals software, and everyone in sanctioned territories from all dYdX software.

dYdX's older v3 exchange shows what a working escape hatch looks like. dYdX shut v3 down in October 2024, and L2BEAT reports that it "is currently processing withdrawals in escape-hatch mode": users withdraw through Ethereum contracts with a proof of their balance, without needing the operator. L2BEAT rated v3 Stage 1, with forced transactions via Ethereum after a 14-day delay and a 9-day exit window before upgrades. dYdX v4, as a separate Layer 1, has no L2BEAT page and no Ethereum escape hatch; users rely on its validator set instead. That set is capped at 21 active validators: the chain's own staking parameters show a maximum of 21 validators (public chain data, read 2 November 2026).

Hyperliquid

Covered in detail in our Hyperliquid review. In brief: on-chain order books on its own Layer 1, an active set of the "top twenty-seven by stake" validators (docs), and node software that is closed source; Hyperliquid told reporters in January 2025 that its "node code is currently closed source" (CoinDesk), and the official node repository distributes a signed binary. L2BEAT describes the Arbitrum bridge as signed by hot and cold sets of 4 validators each, with "no mechanism" for users to force transactions. The website screens wallets, and the terms restrict the US and Ontario; but the terms also say "the Interface is not the exclusive means of accessing Hyperliquid", and the public API stays available.

ApeX Omni

L2BEAT says there is "no delay on code upgrades", no exit window because contracts are "instantly upgradable", and that "users cannot submit forced withdrawal requests"; the contracts contain an exodus mode, but secondary deployments "reject all exit proofs", so it is not a system-wide escape hatch. L2BEAT also notes that a single permissioned validator produces blocks, that "withdrawals can be censored by the permissioned operators", and that funds can be frozen if that validator goes down. We could not load the full text of ApeX's own terms to confirm its restricted regions, so check them directly.

Aster

Covered in our Aster review. The Aster Chain overview says a withdrawal is confirmed once 2 out of 3 validator nodes verify it, external validator participation "is not supported" during Phase 1, and core chain contracts and RPC infrastructure "will not be open-sourced at the moment". Its terms allow suspension "for any reason whatsoever" (section 11.2) and delaying or refusing transfers (section 5.3), and list the US, Canada, the UK, China and others as prohibited. A plus: its 1001x mode has a published direct contract route for when the app is "unavailable or limited".

Full comparison table

For reference, dYdX v3 (now closed) showed the strongest exit design of any exchange here: forced withdrawals through Ethereum and a working escape hatch, per L2BEAT.

Perps only: which perp DEX is most decentralized?

Leverage trading is where most of the trust sits, so we also checked other perp venues still running, using the same questions. Vertex is no longer an option: it wound down its exchanges in July 2025 when its team joined the Ink Foundation.

gTrade (Gains Network). Its docs say "no deposit or signup is required": a trader keeps funds in their own wallet until a trade opens, and trades live in smart contracts. Prices come from "a set of independent Chainlink nodes", and the contract needs answers from at least 3 of them (how orders execute). Vault upgrades and changes that could affect user funds go through a 14-day timelock. The main remaining control point: governance can switch a chain to close-only or fully pause trading, and we did not find a documented timelock for trading-contract upgrades. Its eligibility page prohibits US persons and sanctioned persons.

GMX (v2). (Full details in our GMX review.) Trades are made from the user's wallet into on-chain contracts, and most parameter changes pass through a timelock controller; on Arbitrum its minimum delay reads 24 hours on-chain. Prices come from Chainlink Data Streams. The main remaining control point: orders are executed by keepers that hold special roles, and GMX's own contract README notes that config keepers and timelock admins "could potentially disrupt regular operation". In July 2025 an older GMX v1 pool lost about $42 million to an exploit; GMX reported the funds were recovered after negotiation.

Jupiter Perps. Positions sit in an on-chain Solana program, but trade actions, including withdrawing collateral, are processed by "offchain services operated by Jupiter", which "runs two keepers in parallel" (technical reference). That makes the operator a practical dependency.

Drift. In April 2026 an attacker gained control of Drift's admin powers through a 2-of-5 Security Council multisig with no timelock, and an estimated $285 million was lost (Chainalysis). Drift says its relaunch will use a community-governed multisig and that "timelocks will be enforced on all critical administrative actions" (Drift update). The lesson for every platform: admin keys without a delay are a single point of failure.

On these facts, the perp venues that depend least on one operator are dYdX Chain, gTrade and GMX, roughly in that order, each with the control point shown above. "Least dependent" is not "risk-free": smart contract bugs, oracle failures and liquidations still apply everywhere.

The spectrum

From most self-custodial to most operator-dependent, based on the sources above:

1. Your own wallet plus an immutable on-chain protocol (Uniswap or PancakeSwap spot swaps). The operator can block a website, not your funds.
2. An open-source app-chain (dYdX Chain). Funds sit on a chain run by validators; the code is public, and the official site's restriction mode still lets users withdraw.
3. A closed-source or small-signer app-chain with a public API (Hyperliquid). Fully on-chain trading, but a closed node and a small bridge signer set.
4. Instantly upgradable contracts with no forced exit (ApeX Omni, per L2BEAT).
5. A partly closed chain with a 2-of-3 withdrawal set and broad suspension terms (Aster order-book products, and PancakeSwap Perpetual built on it).

Two cross-cutting points apply to every row. First, stablecoins have their own gatekeeper: Circle's USDC terms reserve the right to "block" addresses, and Tether's terms allow freezing USDT, so even the most decentralized exchange cannot make a stablecoin freeze-proof. Second, a website block is not the same as losing funds, but on platforms with no forced exit, the website and the validators are your only practical way out.

The trade-offs, fairly

More decentralization usually costs something. Immutable spot protocols offer no leverage, charge gas and can slip on big orders. Open app-chains still rely on their validator sets. The more centralized designs exist because they deliver speed, deep order books, high leverage, low fees and features such as privacy, and several of them (Hyperliquid, Aster) have refunded users quickly after outages or glitches. A company behind the platform can also mean support and compensation when something breaks. The right choice depends on what you value; the wrong choice is not knowing which model you are using.

Reader checklist before you deposit

• Find the platform's terms and read the sections on suspension, transfers and restricted regions. If your region is listed, do not use it, and do not try to get around the restriction.
• Check the L2BEAT page if one exists, especially "exit window" and "forced withdrawal".
• Find out who approves withdrawals and how many parties that is.
• Check whether the core code is open source.
• Ask: if the website refused my wallet tomorrow, how would I withdraw? (API, another interface, an escape hatch, or nothing.)
• Keep only trade-size funds on any exchange and withdraw profits to a wallet you control.
• Use a separate, clean wallet for trading, and never interact with unknown tokens; see our dusting case study.
• Size positions so a temporary lockout would not ruin you; see risk management basics and crypto market basics.

Sources

• Uniswap Docs, The Uniswap protocol
• Uniswap Labs Help Center, Address screening guide
• Uniswap Labs, Terms of Service (last modified 28 July 2026)
• PancakeSwap, Terms of Service
• PancakeSwap Docs, What is perpetual trading?
• PancakeSwap Docs, Perpetual trading FAQ
• dYdX Docs, Intro to dYdX Chain architecture
• dYdX, v4-chain source code
• dYdX, dYdX Software Terms of Use (last updated 12 March 2026)
• dYdX Help Center, Geo restrictions and site access (close-only mode), April 2026
• L2BEAT, dYdX v3 (archived; escape hatch)
• dYdX, v3 product sunset
• Hyperliquid, Terms of Use (last updated 15 June 2026)
• Hyperliquid Docs, Running a validator
• Hyperliquid, node repository
• L2BEAT, Hyperliquid
• CoinDesk, HyperLiquid responds to scrutiny over lack of decentralization, 8 January 2025
• L2BEAT, ApeX Omni
• Aster Docs, Aster Chain overview
• Aster Docs, Terms & Conditions
• Aster Docs, 1001x direct contract interaction
• Circle, USDC Terms
• dYdX Chain staking parameters (max_validators 21), public REST endpoint
• GMX Docs, Contract architecture
• GMX, gmx-synthetics README (roles, timelock, keepers)
• GMX, GLP funds on Arbitrum fully recovered (July 2025)
• Gains Network Docs, Trading interface overview
• Gains Network Docs, How orders execute
• Gains Network Docs, Upgrades, updates and timelocks
• Gains Network Docs, Eligibility and restricted regions
• Jupiter Docs, Perps technical reference
• Chainalysis, Lessons from the Drift hack
• Drift, Incident recovery update, 16 April 2026
• PR Newswire, Vertex Protocol team to join Ink Foundation, 8 July 2025

Not financial advice. This article is for general information and education only. It is not a recommendation to buy, sell or hold any asset. Prices move quickly and figures quoted may already be out of date; markets involve risk, including the loss of capital. See our disclaimer.

Related markets: Ethereum Bitcoin BNB