Ostium Arbitrum Perps Skill

Ostium Arbitrum Perps Skill

Trit: 0 (ERGODIC) Category: defi-trading Author: plurigrid/​asi Source: plurigrid/​asi License: MIT

Description

Interact with Ostium Protocol -- a decentralized perpetual exchange on Arbitrum for RWA (Forex, Commodities, Indices, Stocks) and Crypto. Covers contract architecture, testnet deployment, SDK integration, oracle system, vault mechanics, and security auditing via Trail of Bits skills.

When to Use

• Trading perpetuals on Ostium (open/​close/​update trades)
• Auditing Ostium smart contracts (Gains v5 fork lineage)
• Integrating with Ostium Python SDK
• Analyzing Ostium vault (ERC4626, OLP tokens, USDC)
• Price oracle analysis (Stork Network RWA + Chainlink crypto)
• Testnet development on Arbitrum Sepolia

Protocol Overview

Ostium is an open-sourced, non-custodial perpetual exchange on Arbitrum One (L2) enabling leveraged trading of Real World Assets. Forked from Gains Network v5 codebase, customized for RWA oracle infrastructure.

• $20M Series A from General Catalyst + Jump Crypto (2025)
• 562,605+ mainnet transactions on Trading contract
• Audited by: Zellic, ThreeSigma, Pashov (x2: 2025-01-21, 2025-04-06)
• Bug Bounty: Immunefi, up to $100K, USDC on Arbitrum

Architecture

User ──► OstiumTrading ──► OstiumTradingStorage
              │                    │
              ▼                    ▼
     OstiumTradingCallbacks ◄── OstiumPriceRouter
              │                    │
              ▼               ┌────┴────┐
         OstiumVault     PriceUpKeep  PrivatePriceUpKeep
         (ERC4626)       (Chainlink)   (Stork/​Custom)
              │
         OstiumPairInfos ◄── OstiumPairsStorage

Core Contracts

All contracts inherit from Initializable (upgradeable proxy pattern).

Deployed Addresses

Mainnet (Arbitrum One, chainId: 42161)

Testnet (Arbitrum Sepolia, chainId: 421614)

Python SDK

pip install ostium-python-sdk

from ostium_python_sdk import OstiumSDK

# Testnet
sdk = OstiumSDK(rpc_url="YOUR_ARB_SEPOLIA_RPC", private_key="0x...", is_testnet=True)

# Faucet (testnet only)
await sdk.faucet.request_tokens()

# Open a trade
await sdk.trading.perform_trade(trade_params, at_price)

# Close
await sdk.trading.close_trade(pair_id=0, trade_index=0, close_percentage=100)

# Update TP/​SL
await sdk.trading.update_tp(pair_id, trade_index, tp_price)
await sdk.trading.update_sl(pair_id, trade_index, sl_price)

SDK Subgraph Endpoints

• Mainnet: https://subgraph.satsuma-prod.com/​391a61815d32/​ostium/​ost-prod/​api
• Testnet: https://subgraph.satsuma-prod.com/​391a61815d32/​ostium/​ost-sep-final/​api

REST API

# Latest prices for all feeds
curl -s 'https://metadata-backend.ostium.io/​PricePublish/​latest-prices' -H 'Content-Type: application/​json' | jq

# Price for specific feed
curl -s 'https://metadata-backend.ostium.io/​PricePublish/​latest-price?asset=BTC_USD' | jq

Security Audit Checklist (Trail of Bits Skills)

When auditing Ostium contracts, use these loaded skills in order:

1. audit-context-building -- Deep architectural review of Gains v5 fork modifications
2. entry-point-analyzer -- Map all external/​public state-changing functions across 15 contracts
3. secure-workflow-guide -- Run Slither, check upgradeability (proxy pattern), ERC4626 conformance
4. token-integration-analyzer -- Analyze USDC integration, OLP token, LockedDepositNft
5. property-based-testing -- Write invariant tests for vault collateralization, PnL accounting
6. harness-writing -- Echidna/​Medusa harnesses for trading callbacks, oracle price manipulation
7. semgrep-rule-creator -- Custom rules for Gains v5-specific patterns
8. variant-analysis -- Hunt for known Gains Network vulnerability variants

Key Attack Surfaces

• Oracle manipulation: Dual oracle (Chainlink + Stork) price discrepancy exploitation
• Vault accounting: accPnlPerToken rounding, deposit/​withdrawal timing attacks
• Proxy upgrades: ProxyAdmin access, implementation slot manipulation
• Automation race conditions: TradesUpKeep liquidation ordering, MEV
• Collateral management: topUpCollateral/​removeCollateral reentrancy
• Market state transitions: PrivatePriceUpKeep market open/​closed edge cases

Related Repositories

• 0xOstium/​smart-contracts-public -- Solidity contracts (MIT, Hardhat)
• 0xOstium/​ostium-python-sdk -- Python SDK (17 stars)
• Gains Network v5 (upstream fork source)

Related Skills

• secure-workflow-guide
• entry-point-analyzer
• token-integration-analyzer
• audit-context-building
• property-based-testing
• harness-writing

GF(3) Balanced Triad

ostium-arbitrum-perps (0) + secure-workflow-guide (-1) + aptos-trading (+1) = 0